JWT quiz

Test your JWT knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.

What is a key challenge with revoking a JWT before its natural expiration (e.g. on logout or a compromised account)?

1. What is a key challenge with revoking a JWT before its natural expiration (e.g. on logout or a compromised account)?
2. What does the JWT header typically contain?
3. What does "audience" (`aud`) and "issuer" (`iss`) claims let a verifier check?
4. What is the main architectural benefit of JWTs for authenticating stateless/distributed APIs, versus traditional server-side sessions?
5. How is a JWT typically sent in an HTTP request to authenticate the caller?
6. Why can a JWT's size become a practical concern compared to a traditional opaque session ID cookie?
7. Why is putting a long-lived, highly-privileged JWT (e.g. one lasting 30 days) directly in client-side storage generally considered riskier than a short-lived one?
8. What is the difference between JWS (JSON Web Signature) and JWE (JSON Web Encryption)?
9. What does the JWT signature actually protect against?
10. What is a JWT (JSON Web Token)?
11. What is a practical reason to include a minimal set of claims in a JWT rather than embedding a user's entire profile?
12. Why is validating a JWT's signature alone not sufficient — what else must a resource server check before trusting the token's claims?

More quizzes