JWT security checklist

October 11, 2026 · 13 min read

JWTs fail open when verification is incomplete. A checklist beats ad hoc copy-paste from tutorials. Run through these items on every service that calls jwtVerify or framework equivalents before production traffic - and again after key rotation.

Validate signature (and algorithm)

• Reject alg: none and unexpected algorithms (algorithm confusion attacks).
• Pin allowed algs - HS256 only on trusted issuers, RS256/ES256 with JWKS for federated auth.
• Use maintained libraries; never verify by Base64-decoding the payload alone.

Test with the JWT decoder for structure, and the JWT generator for signed fixtures in CI - not for production secrets.

Check expiry and clock skew

Enforce exp with a small clock skew leeway (e.g. 60 seconds). Honor nbf when present. Short-lived access tokens (minutes) plus refresh rotation limits blast radius of stolen tokens.

Verify issuer and audience

Validate iss matches your identity provider and aud matches this API’s identifier. Skipping audience checks lets tokens minted for another service access your resources. Document expected values in OpenAPI security schemes.

Validate payload claims

Treat the payload as untrusted input even after signature verification. Map sub to internal user IDs; do not embed roles without re-checking authorization server state for sensitive actions. Strip PII from logs when debugging - decode locally, redact before sharing.

HTTPS, secure storage, and key hygiene

• HTTPS only in production; HSTS at the edge.
• Prefer HttpOnly cookies or memory for tokens; see JWT storage guide.
• Rotate signing keys with kid in JWKS; validate PEM before deploy.
• Never commit secrets; scan repos for leaked HS256 keys.

Related: Decode JWT safely · JWT security mistakes · JWT storage in browsers

Browse all tools