API Testing · Middle · Question 30 of 75

Which JWT checks should an API tester try?

1Tampered payload, wrong signature, expired exp, alg: none
2Only that the token is shorter than 1000 characters
3That the token's payload is encrypted and unreadable

Show the answer

Correct answer: Tampered payload, wrong signature, expired exp, alg: none

Explanation

A JWT payload is only Base64-encoded. The server must verify the signature and claims; tampered tokens must give 401.

Further reading

Test yourself

Take the API Testing · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.