JWTs are in end like passwords. Sure they have a limited duration. Sure they might not work for all actions. Sure they don't need a password database on the

JWTs are in end like passwords. Sure they have a limited duration. Sure they might not work for all actions. Sure they don't need a password database on the side of the receiver. But it's best to treat them like temporary password + some arbitrary metadata. So no, they don't protect you from corrupted clients, they just limit the damage in what can happen and when it can happen but the corrupt client can still do all kinds of bad things. Edit: I need a different Android keyboard, this is driving me nuts.