diff --git a/website/sandbox/learnpianochords/src/server/Spec.hs b/website/sandbox/learnpianochords/src/server/Spec.hs
index 6c683cbbf..20c7b96b9 100644
--- a/website/sandbox/learnpianochords/src/server/Spec.hs
+++ b/website/sandbox/learnpianochords/src/server/Spec.hs
@@ -16,6 +16,9 @@ main = hspec $ do
   describe "GoogleSignIn" $
     describe "jwtIsValid" $ do
       let jwtIsValid' = GoogleSignIn.jwtIsValid True
+      it "returns a decode error when an incorrectly encoded JWT is used" $ do
+        jwtIsValid' (GoogleSignIn.EncodedJWT "rubbish") `shouldReturn` DecodeError
+
       it "returns validation error when the aud field doesn't match my client ID" $ do
         let auds = ["wrong-client-id"]
                    |> fmap TestUtils.unsafeStringOrURI