How to test JWT security in Java

Use Java to confirm your API rejects forged JWTs. Generate educational attack variants with the browser JWT Fuzzer (tampered payloads, expired exp, alg:none), then assert failures with java-jwt JWT.require allowlists. Only test systems you own or have written authorization to assess — never attack third-party production.

Last updated August 26, 2026

Steps

  1. 1

    Paste a development JWT you own into the JWT Fuzzer and generate test variants.

  2. 2

    Note which variants you will try: invalid signature, expired exp, and algorithm confusion (alg:none).

  3. 3

    In Java, call your verifier with java-jwt JWT.require allowlists and assert each variant is rejected.

  4. 4

    Pin an explicit algorithm allowlist in production so unexpected algs cannot slip through.

  5. 5

    Document results in your security checklist; do not run these tests against unauthorized targets.

Code Example

Java
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;

// AUTHORIZED / LAB USE ONLY — paste variants from the JWT Fuzzer
try {
    JWT.require(Algorithm.HMAC256(secret)).build().verify(tamperedToken);
    throw new IllegalStateException("Expected verification to fail");
} catch (JWTVerificationException expected) {
    // Bad signature, expired exp, or algorithm mismatch should land here
}
// Never accept alg:none; pin algorithms in production verifiers
Open JWT Fuzzer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Common Jwt VulnerabilitiesHow To Validate Jwt Token

Frequently Asked Questions

Is JWT fuzzing legal?

Only test systems you own or have explicit written authorization to test. Unauthorized probing can violate laws and terms of service.

How should Java reject bad JWTs?

Use java-jwt JWT.require allowlists with an algorithm allowlist, validate exp/nbf, and treat any verify failure as 401. Never fall back to decode-only when authentication fails.

What does the JWT Fuzzer simulate?

Common failure modes: tampered payloads, invalid signatures, expired tokens, and algorithm confusion such as alg:none. It is an educational helper for development labs.

Should my API accept alg:none?

Never. Always specify allowed algorithms in your JWT library and reject tokens that advertise none or any algorithm outside the allowlist.