How to test JWT security in Node.js

Use Node.js to confirm your API rejects forged JWTs. Generate educational attack variants with the browser JWT Fuzzer (tampered payloads, expired exp, alg:none), then assert failures with jsonwebtoken verify allowlists. Only test systems you own or have written authorization to assess — never attack third-party production.

Last updated August 26, 2026

Steps

  1. 1

    Paste a development JWT you own into the JWT Fuzzer and generate test variants.

  2. 2

    Note which variants you will try: invalid signature, expired exp, and algorithm confusion (alg:none).

  3. 3

    In Node.js, call your verifier with jsonwebtoken verify allowlists and assert each variant is rejected.

  4. 4

    Pin an explicit algorithm allowlist in production so unexpected algs cannot slip through.

  5. 5

    Document results in your security checklist; do not run these tests against unauthorized targets.

Code Example

Node.js
const jwt = require('jsonwebtoken');

// AUTHORIZED / LAB USE ONLY — paste variants from the JWT Fuzzer
function expectReject(tamperedToken, secret) {
  try {
    jwt.verify(tamperedToken, secret, { algorithms: ['HS256'] });
    throw new Error('Expected verification to fail');
  } catch (e) {
    if (!['JsonWebTokenError', 'TokenExpiredError', 'NotBeforeError'].includes(e.name)) {
      throw e;
    }
  }
}

expectReject(tamperedToken, process.env.JWT_SECRET);
// Production rule: always allowlist algorithms — never accept alg:none
Open JWT Fuzzer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Common Jwt VulnerabilitiesHow To Validate Jwt Token

Frequently Asked Questions

Is JWT fuzzing legal?

Only test systems you own or have explicit written authorization to test. Unauthorized probing can violate laws and terms of service.

How should Node.js reject bad JWTs?

Use jsonwebtoken verify allowlists with an algorithm allowlist, validate exp/nbf, and treat any verify failure as 401. Never fall back to decode-only when authentication fails.

What does the JWT Fuzzer simulate?

Common failure modes: tampered payloads, invalid signatures, expired tokens, and algorithm confusion such as alg:none. It is an educational helper for development labs.

Should my API accept alg:none?

Never. Always specify allowed algorithms in your JWT library and reject tokens that advertise none or any algorithm outside the allowlist.