SAMPLE JWT — RS256, Signed by the Wrong Key
A perfectly well-formed RS256 signature made with the SAMPLE root key while the kid header still names the leaf key. Verifiers that trust the kid without checking the signature against that exact key accept it.
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Im5vdnVzLXA3LXJzYS0yMDI2In0.eyJpc3MiOiJodHRwczovL2lzc3Vlci5wa2kuc2FtcGxlLmV4YW1wbGUvIiwic3ViIjoidXNlci1zYW1wbGUtMDAwMSIsImF1ZCI6Im5vdnVzLXA3LXNhbXBsZS1hcGkiLCJpYXQiOjE3NjcyMjU2MDAsIm5iZiI6MTc2NzIyNTYwMCwiZXhwIjoyMDgyNzU4NDAwLCJqdGkiOiJub3Z1cy1wNy1zYW1wbGUtMDAwMSIsIm5hbWUiOiJTYW0gUml2ZXJhIChTQU1QTEUpIiwic2NvcGUiOiJyZWFkOnNhbXBsZSJ9.buYKqukhqX1WWLyJYQXH7agdXHsbwhoJ3ayFgiL08UrGT7b8sQjDQ6AkruQ9j5kjB-nZBLz1v2hKLfvGVPrJSjZRsIWMDWB73ZCFOneJ0WeYlXU51zIrSbjf69TbZMj2xeVTkrJ9r54iPXwLAjEzs8cbYqEz576DxlvImYuG7uJOKgVl9RoVg4s0FFrvlSwwNG71HJC1gApTniAHb661FgY1ZgN7KnJ87W5dDuTIfyHYk8Zij0P3NoirC-BQnGykncGoEgDzjxMrv1gQ7I_JXTWo0xLuv1oVnn7cdoBFXWWSDSQfxO1gyFd3daL1JECjyvYjeE8SwmMI1tP4-n1xA5M4wXWAW0gc3wvMBAEUSX69IDQPzXg52GwrJod8mmt8lR3abcdKdQDKVpZfZyVK4B7MJEG9mOlUiCZZ8bimNsl7VwhL1GWTebJA3UiPqUevoQfrHVqAYJQS1WLbo0kA_HIyCz6dKT2pAy-lni6GiRuspgEZTAB1c5mYfFiD_C4uTRLlA1uv9muwG2BPdr6i_7msOSOpkiO0lTgrk2axuXASvGG6ObaO5vCd1Ti7wIOYx_leDq3ZusB0IZHJGqQE6f7PnaazL9nUeNPdvlolrF678sLcOZLscBK_o94dEzJ_BCoLPZYwOTeVIlS0F7PELvf4031diLMCnMCFBZ0S3uo
Specifications
- Alg
- RS256
- Kid
- novus-p7-rsa-2026
- Issue
- signed with the SAMPLE root key, kid claims the leaf key
- Signature
- cryptographically well-formed
- Valid
- false
- Sub
- user-sample-0001
- Sample Only
- true
- Seed
- 70117
Testing contract
Expected to fail- Scenario
- Resolve the key by kid from the p7 JWK set and verify the signature with it.
- Expected result
- Verification fails because the signature was made by a different key than the one the kid resolves to.
What is a .jwt file?
A JWT (JSON Web Token) is a compact, URL-safe token made of three base64url-encoded parts — a header, a payload of claims, and a signature — separated by dots. It is widely used to carry authentication and authorisation claims between services.
How to use this file
Use a sample JWT to test token decoding, claim extraction, and signature verification. Never use an example token's secret in production.
How to use this file for testing
“SAMPLE JWT — RS256, Signed by the Wrong Key” is a deterministic Novus Examples fixture for JWT / JWKS testing, Error handling. Unsigned and SAMPLE-signed JWT variants plus JWKS documents — published sample material only, for auth parser tests.
Documented properties for this file: seed 70117 · intentionally invalid. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
This is published, SAMPLE-only security material — never a real secret. Point certificate, key, or token parsers at it, test PEM/DER decoding and PKCS handling, and confirm your tooling reads the documented fields; any sample password is printed on this page.
These JSON fixtures are synthetic SAMPLE auth or tool-call shapes for harnesses — never production secrets or live tokens. Validate schema fields and alg variants against the documented role.
Code examples
cut -d. -f1 jwt-rs256-wrong-key.jwt | base64 -d; echo
cut -d. -f2 jwt-rs256-wrong-key.jwt | base64 -d; echo # payload claimsRelated files
- jwtJWT — Intentionally Invalid SegmentsIntentionally invalid JWT (truncated) for parser error-path tests.
- jwtJWT (HS256 Expired) — SAMPLESAMPLE HS256 JWT with a past exp claim — for expiry-validation harnesses.
- jsonJWKS (Empty Keys) — SAMPLEEmpty JWKS keys array for edge-case JWKS loaders.
- jsonOAuth Error — Insufficient ScopeOAuth 2.0 SAMPLE error JSON (insufficient_scope) for client error-path tests.
- jsonOAuth Error — Invalid ClientOAuth 2.0 SAMPLE error JSON (invalid_client) for client error-path tests.
- jsonOAuth Error — Invalid GrantOAuth 2.0 SAMPLE error JSON (invalid_grant) for client error-path tests.
Generated by generation/security_p7.py. Free for any use, no attribution required — license.