JWT

A JSON Web Token (JWT, often pronounced “jot”) is a string with three Base64url-encoded parts separated by dots: a header saying how it was signed, a payload of claims, and a signature. APIs commonly receive it in the Authorization: Bearer <token> header and verify the signature to trust the claims without a database lookup. Many OAuth 2.0 and OpenID Connect providers issue access tokens and ID tokens as JWTs.

Example

A decoded payload:

{
  "iss": "https://auth.example.com",
  "sub": "user_7f3a",
  "aud": "orders-api",
  "role": "member",
  "iat": 1767225600,
  "exp": 1767229200
}

iss is the issuer, sub the subject (usually the user), aud the intended recipient, and iat/exp the issue and expiry times in seconds since the Unix epoch. Reading the payload in Node 22 needs no library:

const [, payload] = token.split('.');
const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));

Encoded, not encrypted

A standard signed JWT (a JWS) is encoded, not encrypted. Anyone who has the token can read every claim, as the snippet above shows. The signature only proves the token was issued by someone with the key and has not been altered. So never put secrets or personal data in a JWT payload unless the token is actually encrypted (a JWE, a separate and less common format). Decoding a token is not the same as validating it: a test that decodes a token has checked nothing about its authenticity.

What to test

• Expired token: set or wait for exp to pass and expect 401.
• Tampered payload: change role to admin, keep the old signature, and expect 401. Acceptance means the server is not verifying signatures.
• alg: none: a token with no signature must be rejected.
• Wrong audience or issuer: a valid token for another API should not work here.
• Valid token, wrong permissions: expect 403, not 401, because the user is authenticated but not authorized.
• Logout and revocation: JWTs are usually valid until they expire, so check what the system does after logout or a password change. Short expiry plus refresh tokens is the common mitigation.