Let's suppose I search for 'jwt' and end up at 'jwt.io' (run by Auth0), which talks about what JWT is and lists a bunch of libraries. Let's say I want to use python.

One library checks for key lengths [1] and throws exceptions, another one doesn't [2] -- in fact it uses a quickstart example that should obviously fail.

[1] https://github.com/latchset/jwcrypto/ [2] https://github.com/mpdavis/python-jose

I generated this one with jwt.io, but after testing it looks like pyjwt (which is a very common library) does exactly the same thing