I Audited 12 Open Source JWT Implementations and Found the Same 6 Mistakes

I spent last month reviewing JWT implementations across 12 open-source Node.js projects on GitHub — ranging from starter templates with 2k stars to production boilerplates used by teams at real companies. I found the same 6 mistakes in almost every one.

None of these projects are bad. The developers are skilled. The mistakes are subtle, copy-paste errors from tutorials that nobody questioned.

Here they are.

Mistake 1 — The Secret Is Literally "secret"

I found this in three separate projects:

const token = jwt.sign({ userId: user.id }, "secret", { expiresIn: "1h" });

This secret is in every JWT tutorial on the internet. It is in the jwt.io documentation. It is in the jsonwebtoken README. Developers copy it and forget to replace it.

A 6-character ASCII secret has approximately 42 bits of entropy. A GPU cluster cracks it from a dictionary in milliseconds. for generating secrets — it runs entirely in the browser using the Web Crypto API, nothing is sent to a server, and it produces the right bit length for your algorithm.