How to test JWT security in Ruby

Use Ruby to confirm your API rejects forged JWTs. Generate educational attack variants with the browser JWT Fuzzer (tampered payloads, expired exp, alg:none), then assert failures with ruby-jwt decode with algorithm pin. Only test systems you own or have written authorization to assess — never attack third-party production.

Last updated August 26, 2026

Steps

  1. 1

    Paste a development JWT you own into the JWT Fuzzer and generate test variants.

  2. 2

    Note which variants you will try: invalid signature, expired exp, and algorithm confusion (alg:none).

  3. 3

    In Ruby, call your verifier with ruby-jwt decode with algorithm pin and assert each variant is rejected.

  4. 4

    Pin an explicit algorithm allowlist in production so unexpected algs cannot slip through.

  5. 5

    Document results in your security checklist; do not run these tests against unauthorized targets.

Code Example

Ruby
require 'jwt'

# AUTHORIZED / LAB USE ONLY — paste variants from the JWT Fuzzer
begin
  JWT.decode(tampered_token, secret, true, { algorithm: 'HS256' })
  raise 'Expected verification to fail'
rescue JWT::DecodeError, JWT::ExpiredSignature, JWT::IncorrectAlgorithm
  # Expected for fuzzer variants
end
# Never test production systems without authorization
Open JWT Fuzzer

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Common Jwt VulnerabilitiesHow To Validate Jwt Token

Frequently Asked Questions

Is JWT fuzzing legal?

Only test systems you own or have explicit written authorization to test. Unauthorized probing can violate laws and terms of service.

How should Ruby reject bad JWTs?

Use ruby-jwt decode with algorithm pin with an algorithm allowlist, validate exp/nbf, and treat any verify failure as 401. Never fall back to decode-only when authentication fails.

What does the JWT Fuzzer simulate?

Common failure modes: tampered payloads, invalid signatures, expired tokens, and algorithm confusion such as alg:none. It is an educational helper for development labs.

Should my API accept alg:none?

Never. Always specify allowed algorithms in your JWT library and reject tokens that advertise none or any algorithm outside the allowlist.