Academy
Expert track

JWT Attacks

Trusting tokens: alg confusion, none, and weak secrets.

Create a free account to track progress and earn the certificate. You can read the syllabus below without one.

Final exam

3 questions in 10 minutes, 3 to pass. Certificates require it.

Take the exam
  1. 01How JWTs breakDecode, tamper, and the three classic verification failures.
  2. 02Lab: the unsigned adminA verifier that trusts the header. Decode, tamper, strip.
  3. 03JWT quizThree questions on alg trust, confusion, and secrets.