Glossary
JSON WEB TOKEN / JWT
defined.
A compact, URL-safe token format used for stateless authentication and authorization, typically signed with HMAC or RSA/ECDSA.
A–Z
A compact, URL-safe token format used for stateless authentication and authorization, typically signed with HMAC or RSA/ECDSA.
JWTs encode claims (subject, expiry, audience) in a Base64URL payload, signed to detect tampering. Common security failures: alg=none bypass, weak HMAC secrets recoverable via jwt_tool, algorithm confusion (RS256 to HS256), and unrestricted kid headers leading to SQL injection or file disclosure.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.