JWT.io Debugger does validate at all. Considers ANY secret as valid. How is this possible?

[suchislife801]

1. Go to JWT.io right now and under Verify Signature which contains “your-256-bit-secret” go ahead and type anything in. I mean ANYTHING. What do you see?

Signature Verified.

2. Go to JWT.io again, then copy & paste your perfectly fine custom JWT in the Encoded Box. Now enter your custom Secret. What do you see?

Signature Verified.

3. Now go ahead modify your custom Secret under Verify Signature. Yep, go ahead and smash buttons on your keyboard. Type anything. Yes, really. What do you see?

Signature Verified.

How is this possible?

[tyf]

Hey there @suchislife801 !

I believe this answers your question:

Jwt.io debugger always returning signature verified with random using a random key

If you change an HS256 key value on jwt.io the signature component is updated automatically so the signature would be verified as it was just updated. If you want to check the signature of an existing token then first set the key value and only after paste the existing token.

[suchislife801]

And you couldn’t just code it so it works both ways?