# Weak JWT Algorithm

> Detects JWT usage with weak or insecure signing algorithms including HS256 with short secrets, RS256 key confusion, and algorithm downgrade.

- Skill: `zakirkun/weak-jwt-algorithm` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/weak-jwt-algorithm`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/weak-jwt-algorithm/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/weak-jwt-algorithm

---


# Weak JWT Algorithm

## Overview
JWT algorithm issues include:
1. **HS256 with short key**: HS256 keys shorter than 256 bits are brute-forceable
2. **Algorithm confusion (RS256 → HS256)**: Public key used as HMAC secret when server accepts both
3. **Explicit `none` algorithm**: No signature required
4. **Embedded JWK in header**: Attacker provides their own public key

## Remediation
- Use RS256 or ES256 for production systems (asymmetric keys)
- If using HS256, use a random 32+ byte secret
- Restrict accepted algorithms explicitly: `algorithms: ['RS256']`
- Never allow `none` algorithm