Top 7 Critical JWT Mistakes Developers Make & How to Avoid Them

The 7 Critical Pitfalls

1. **Accepting "alg": "none"**: Failing to enforce an algorithm whitelist, allowing unsigned forged tokens. 2. **Weak or Predictable Secrets**: Using secrets shorter than 256 bits, vulnerable to offline hashcat cracking. 3. **Storing Tokens in localStorage**: Exposing tokens to any cross-site scripting (XSS) vulnerability. 4. **No Expiration Claim (exp)**: Issuing tokens that live indefinitely. 5. **Putting Sensitive Data in Claims**: Storing credit cards, passwords, or PII in Base64URL-encoded payloads. 6. **Confusing Decoding with Verification**: Extracting user data from unverified tokens. 7. **Missing Audience (aud) Validation**: Permitting a token issued for one service to be accepted by another service.

Generate in Browser

Need a cryptographically secure JWT secret right now?

Generate 128 to 512-bit keys in Hex or Base64 using Web Crypto with zero server transmission.

Launch Generator

Frequently Asked Questions

How do I protect against XSS token theft?

Store access tokens in memory or in an HttpOnly, Secure, SameSite=Strict cookie so JavaScript cannot access the token string.

Related Technical Guides

JWT Algorithms

HS256 Secret Key Requirements: Specifications, Code Examples, and Common Traps

Learn the official RFC 7518 requirements for HS256 JWT keys. Understand key derivation, minimum byte lengths, and implementation examples.

Implementation

Rotating JWT Signing Secrets with Zero Downtime: The Key ID (kid) Strategy

Zero-downtime JWT secret rotation: how to use the "kid" header parameter to support multiple active verification keys during rollover.