# 3 Ways JWTs Get Forged, and the One Rule That Stops Them All

Page: https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646/3-ways-jwts-get-forged-and-the-one-rule-that-stops-them-all
Text version: https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646/3-ways-jwts-get-forged-and-the-one-rule-that-stops-them-all.md
Podcast: [Cybersecurity Tech Brief By HackerNoon](https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646)
Published: 2026-07-27T16:01:35+00:00
Episode link: https://share.transistor.fm/s/dcb29a8c
Audio file: https://media.transistor.fm/dcb29a8c/9b427fb0.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cybersecurity-tech-brief-by-hackernoon-6365646/episodes/3-ways-jwts-get-forged-and-the-one-rule-that-stops-them-all
Duration seconds: 389

## Resource

This story was originally published on HackerNoon at: https://hackernoon.com/3-ways-jwts-get-forged-and-the-one-rule-that-stops-them-all . A practical walkthrough of three JWT forgery attacks involving unsigned tokens, weak secrets, and algorithm confusion. Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity . You can also check exclusive content about #jwt-token , #penetration-testing , #jwt-authentication , #jwt-security , #weak-jwt-secrets , #hmac-cracking , #authentication-security , #secure-token-validation , and more. This story was written by: @elobeid . Learn more about this writer by checking @elobeid's about page, and for more stories, please visit hackernoon.com . I walk through the three JWT attacks I actually test for: changing the algorithm to none, cracking weak HMAC secrets offline, and confusing an RS256 verifier into accepting an HS256 token signed with the public key. All three exploit weak assumptions in how the server verifies the token.

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cybersecurity-tech-brief-by-hackernoon-6365646/episodes/3-ways-jwts-get-forged-and-the-one-rule-that-stops-them-all/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cybersecurity-tech-brief-by-hackernoon-6365646/3-ways-jwts-get-forged-and-the-one-rule-that-stops-them-all.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.