Decode every token you are handed. The algorithm, the signature and the claims are three separate chances for the server to trust something it should not.
Authentication bugs are rarely about cracking anything. They are about the flow: a step you can skip, a token that is trusted because it was signed by nobody, a reset code that never expires, a lockout counter that resets when you change one header.
Numbered low to high.
A token handled entirely in JavaScript. Read what the page does with it.
Paid content behind a claim you control.