QA ENGINEERING GUIDE

JWT Explained for Testers

Understand JWT structure, claims and practical API testing checks.

JWT structure

A compact JWT normally contains a header, payload and signature separated by dots. The header describes the algorithm and token type; the payload contains claims.

What testers should verify

Test token presence, expiry, issuer and audience where applicable. Verify that protected endpoints reject missing, expired, malformed and unauthorized tokens.

Important security distinction

Decoding a JWT only reveals its contents. It does not validate the signature. A test environment should separately verify token validation behavior.

Negative cases

Try missing tokens, malformed tokens, expired tokens, tokens with incorrect audience or issuer, and tokens belonging to users without required permissions.

Do not leak secrets

Avoid logging full production tokens. Mask credentials and sensitive values in automated test reports.