Test your JWT knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.
Question 1/5Score 0
What does the JWT signature actually protect against?
Questions in this quiz
What does the JWT signature actually protect against?
What is the difference between JWS (JSON Web Signature) and JWE (JSON Web Encryption)?
Why is it important to explicitly verify the `alg` field before trusting a JWT, rather than blindly using whatever algorithm the token itself claims?
What is the `exp` claim used for?
Where should a JWT be stored client-side in a browser-based web app, and what is the security trade-off?
Why is putting a long-lived, highly-privileged JWT (e.g. one lasting 30 days) directly in client-side storage generally considered riskier than a short-lived one?
What does the JWT header typically contain?
Why can a JWT's size become a practical concern compared to a traditional opaque session ID cookie?
What does "audience" (`aud`) and "issuer" (`iss`) claims let a verifier check?
What is the difference between the `HS256` and `RS256` signing algorithms?
What is a key challenge with revoking a JWT before its natural expiration (e.g. on logout or a compromised account)?
What is the main architectural benefit of JWTs for authenticating stateless/distributed APIs, versus traditional server-side sessions?