November 5, 2026
The Five-Check JWT Chain: How I Break Token Auth Before I Touch the Business Logic
Most JSON Web Token bugs die on the first three checks. Here’s the exact order I run them, and why I never start with the clever stuff.
By The XSS Rat
7 min read
Here is a confession that has made me money more than once: I almost never read a target's clever single-sign-on documentation before I attack its tokens. I grab a JSON Web Token, I run the same five checks in the same order, and more often than not one of the first three hands me somebody else's account. JWTs have a reputation for being the grown-up, cryptographically-serious way to do authentication, and that reputation is exactly why people stop paying attention to them. They see three Base64 blobs and a signature and assume the maths is somebody else's problem.
It isn't. The signature only matters if the server actually checks it properly, and an astonishing number of servers do not. So let me walk you through the exact chain I run on every token I find, from the thirty-second check at the top to the slow business-logic grind at the bottom. If you hunt bugs, prep for a web certification, or just want to stop being intimidated by the word "cryptographic", this is the mental model to steal.
First, know what you are actually holding
A JWT is not encrypted. I will say that again because it is the single misunderstanding that keeps people from finding bugs: a JWT is encoded, not encrypted. Anyone who holds the token can read every claim…