JWT Security Calculator

JWT score = algorithm (25 EdDSA/ES256 … 0 header-supplied) + claim validation (20 full … 0 signature only) + lifetime score (10 at ≤5 min … 0 above a day) + 12 refresh rotation + 10 revocation + storage (10 HttpOnly cookie … 0 localStorage) + 8 key pinning + 5 audience scoping = 100. The algorithm term is weighted highest because accepting the alg header lets an attacker present alg=none or swap RS256 for HS256 and sign with the public key. Storage and lifetime are the next largest because they set what a stolen token is worth: a fifteen-minute token in an HttpOnly cookie is a much smaller prize than a day-long token in localStorage.

A JWT is a bearer credential your server trusts without a database lookup, so every verification shortcut — unpinned algorithm, unverified audience, no revocation — is directly exploitable.

This calculator takes 8 inputs: Signing algorithm and verification, Claim validation, Access token lifetime, Refresh token rotation with reuse detection, Revocation or deny-list checked on logout, Browser storage, Key identifier pinned to a trusted JWKS, Audience-scoped, least-privilege claims. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because localStorage is readable by any script on the origin, so a single XSS exfiltrates every token. An HttpOnly Secure cookie is not script-readable, and holding the token only in memory limits exposure to the current page. Both need CSRF protection, which is a smaller problem than token theft.

They reduce it but do not remove it. Without a revocation check, logout and 'sign out everywhere' are advisory until the token expires, and a compromised account stays usable for the full remaining lifetime. Pair short access tokens with rotating refresh tokens and a deny-list for the access tokens you must kill immediately.