How JWTs break
Decode, tamper, and the three classic verification failures.
A JWT is three base64 segments — header, payload, signature — and its security lives entirely in verification. Decode is free: anyone reads the claims. Trust must come from the signature check, and that check fails in three classic ways.
First, alg:none: tokens that declare no signature, accepted by servers that honor the header's algorithm choice instead of enforcing their own. Strip the signature, set alg to none, become anyone. Second, confusion: an RS256 server handed an HS256 token verifies the RSA public key as an HMAC secret — public data becomes the signing key. Third, weak secrets: short HMAC passwords fall to offline guessing, and the token never tells you it was easy.
The defenses: enforce the expected algorithm server-side (never trust the header), require strong random HMAC secrets or asymmetric keys kept private, keep lifetimes short, and verify every step of multi-token flows instead of the last one.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.