Security Tools
Understanding JWT: A Developer's Guide
Learn how JWT tokens work, their structure, authentication use cases, and security best practices.
JSON Web Tokens (JWT) are a compact, URL-safe way to represent claims between two parties. They're widely used for authentication in modern web applications.
JWT Structure
A JWT has three parts: header.payload.signature
- Header: Token type and signing algorithm (e.g., HS256)
- Payload: Claims about an entity (user data, expiration, etc.)
- Signature: Ensures the token hasn't been tampered with
How JWT Authentication Works
- User logs in with credentials
- Server validates and generates a signed JWT
- Client stores the JWT and sends it with each request
- Server validates the signature and expiration
Security Best Practices
- Set short expiration times (15-60 minutes)
- Always use HTTPS
- Store in httpOnly cookies, not localStorage
- Don't put sensitive data in the payload (it's only encoded, not encrypted)
- Validate signature and expiration on every request
Frequently Asked Questions
Can I decode a JWT without the secret?
Yes. The header and payload are only Base64URL-encoded, not encrypted. But you cannot verify or create valid signatures without the secret.
What is the difference between JWT and OAuth?
JWT is a token format. OAuth 2.0 is an authorization framework. OAuth often uses JWTs as access tokens.
How long should a JWT be valid?
Access tokens: 15-60 minutes. Use refresh tokens for longer sessions without re-authentication.