JWT Security: Decode Tokens Safely and Dodge the Classic Attacks

JSON Web Tokens look intimidating — three base64 blobs glued with dots — but they're among the simplest auth artifacts to inspect. Understanding what's inside yours is the first line of defense.

Anatomy in 30 seconds

A JWT is header.payload.signature. The header declares the algorithm ({"alg":"HS256","typ":"JWT"}). The payload carries claims: sub (user), iat/exp (issued/expires), plus custom data. The signature is HMAC or RSA over the first two parts. Crucial fact: header and payload are base64url-encoded, not encrypted. Anyone can read them — never put secrets in a JWT payload. Paste a token into the JWT decoder to see this for yourself; it's fully client-side, so your token never leaves the page.

Attack #1: alg=none

The JOSE spec reserved "alg":"none" for unsecured tokens. Some libraries accept it even in production — an attacker rewrites the header to alg:none, strips the signature, and becomes any user. Fix: server must whitelist the exact expected algorithm and reject everything else.

Attack #2: algorithm confusion (RS256→HS256)

Server uses RSA: verifies with a public key. If the verification code trusts the token's alg header, an attacker switches to HS256 and signs with the public key as the HMAC secret — which by definition is public. Fix: pin the algorithm server-side, not the header's say-so.

Attack #3: weak HMAC secrets

HS256 tokens are only as strong as the secret. "secret", "password123", the project name — cracking rigs grind through millions per second. Secrets should be 256+ bits of CSPRNG output, stored in a secrets manager, rotated on any suspicion.

Expiry and revocation gaps

Every production token needs a short exp — 15 minutes is a sane default — plus a refresh-token flow. Stateless JWTs can't be individually revoked; for logout-is-instant requirements, keep a blocklist (jti → TTL) or move to short-lived tokens with rotation. Also validate iss and aud — a token minted for service A shouldn't authenticate to service B.

The safe debugging workflow

When an auth bug hits: decode locally (offline tool, not a random website that might log tokens), check exp vs your clock first — clock skew is the silent killer ("token expired" at 4:59 when it expires at 5:00 because a container's clock drifted). Then verify claims, then algorithm config. Never paste production user tokens into third-party websites.