Skip to content
ENExplore Calculators

JWT Security Calculator

Score a JWT deployment on algorithm, claim validation, token lifetime, rotation, revocation and browser storage.

About JWT Security Calculator

The algorithm term is weighted highest because accepting the alg header lets an attacker present alg=none or swap RS256 for HS256 and sign with the public key. Storage and lifetime are the next largest because they set what a stolen token is worth: a fifteen-minute token in an HttpOnly cookie is a much smaller prize than a day-long token in localStorage. A JWT is a bearer credential your server trusts without a database lookup, so every verification shortcut — unpinned algorithm, unverified audience, no revocation — is directly exploitable.

Formula

JWT Security

JWT score = algorithm (25 EdDSA/ES256 … 0 header-supplied) + claim validation (20 full … 0 signature only) + lifetime score (10 at ≤5 min … 0 above a day) + 12 refresh rotation + 10 revocation + storage (10 HttpOnly cookie … 0 localStorage) + 8 key pinning + 5 audience scoping = 100.

algorithm
Signing algorithm and whether it is pinned
lifetime score
Rewards short-lived access tokens

Worked example

With the default values below, JWT Security Calculator returns JWT Score of 67. Change any input above and every figure here is recalculated in your browser.

Inputs used

Signing algorithm and verificationone of EdDSA or ES256 with a pinned algorithm — 25, RS256 with a pinned algorithm — 22, HS256 with a 256-bit secret — 16, HS256 with a short or shared secret — 4, Algorithm taken from the token header — 0
RS256 with a pinned algorithm — 22
Claim validationone of iss, aud, exp, nbf and sub all verified — 20, exp and aud verified — 14, exp only — 6, Signature only — 0
exp and aud verified — 14
Access token lifetimeaccepts 1–10,080 minutes
15 minutes
Refresh token rotation with reuse detection
No
Revocation or deny-list checked on logout
No
Browser storageone of HttpOnly Secure cookie — 10, In memory only — 8, sessionStorage — 3, localStorage — 0
HttpOnly Secure cookie — 10
Key identifier pinned to a trusted JWKS
Yes
Audience-scoped, least-privilege claims
Yes

Results

JWT Score
67 / 100
JWT Grade
C — Fair
Stolen Token Validity
15 minutes
Most Critical Gap
Add a revocation check so logout takes effect
Algorithm Assessment
Strong — asymmetric signing with the algorithm pinned
Residual Exposure
33%

Step by step

  1. 1Values used
  2. 2JWT Security
  3. 3JWT Score= 67 / 100
  4. 4JWT Grade= C — Fair
  5. 5Stolen Token Validity= 15 minutes
  6. 6Most Critical Gap= Add a revocation check so logout takes effect
  7. 7Algorithm Assessment= Strong — asymmetric signing with the algorithm pinned
  8. 8Residual Exposure= 33

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is JWT Security calculated?

JWT score = algorithm (25 EdDSA/ES256 … 0 header-supplied) + claim validation (20 full … 0 signature only) + lifetime score (10 at ≤5 min … 0 above a day) + 12 refresh rotation + 10 revocation + storage (10 HttpOnly cookie … 0 localStorage) + 8 key pinning + 5 audience scoping = 100. The algorithm term is weighted highest because accepting the alg header lets an attacker present alg=none or swap RS256 for HS256 and sign with the public key. Storage and lifetime are the next largest because they set what a stolen token is worth: a fifteen-minute token in an HttpOnly cookie is a much smaller prize than a day-long token in localStorage.

Why does JWT Security matter?

A JWT is a bearer credential your server trusts without a database lookup, so every verification shortcut — unpinned algorithm, unverified audience, no revocation — is directly exploitable.

What values do I need to enter?

This calculator takes 8 inputs: Signing algorithm and verification, Claim validation, Access token lifetime, Refresh token rotation with reuse detection, Revocation or deny-list checked on logout, Browser storage, Key identifier pinned to a trusted JWKS, Audience-scoped, least-privilege claims. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why not store the JWT in localStorage?

Because localStorage is readable by any script on the origin, so a single XSS exfiltrates every token. An HttpOnly Secure cookie is not script-readable, and holding the token only in memory limits exposure to the current page. Both need CSRF protection, which is a smaller problem than token theft.

Do short lifetimes remove the need for revocation?

They reduce it but do not remove it. Without a revocation check, logout and 'sign out everywhere' are advisory until the token expires, and a compromised account stays usable for the full remaining lifetime. Pair short access tokens with rotating refresh tokens and a deny-list for the access tokens you must kill immediately.

Related Calculators

JWT Security Calculator – Calculate JWT Score & JWT Grade