diff --git a/cmd/jwt/app.go b/cmd/jwt/app.go
index 75db9d2..a78d81a 100644
--- a/cmd/jwt/app.go
+++ b/cmd/jwt/app.go
@@ -205,5 +205,8 @@ func signToken() error {
 }
 
 func isEs() bool {
-	return (*flagAlg)[0:2] == "ES"
+	if alg := *flagAlg; len(alg) >= 2 && alg[0:2] == "ES" {
+		return true
+	}
+	return false
 }