Master JSON Web Tokens for authentication and authorization.
JSON Web Tokens (JWT) are an open, industry-standard RFC 7519 method for representing claims securely between two parties.
#
JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure.
#
A JWT consists of three parts separated by dots:
1. Header: Contains the algorithm and token type 2. Payload: Contains the claims (data) 3. Signature: Verifies the token integrity
``
header.payload.signature
`
#
`
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
`
#
Header:
`json
{
"alg": "HS256",
"typ": "JWT"
}
`
Payload:
`json
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}
`
#
- Issuer - Subject - Audience - Expiration time - Not before - Issued at#
JWT supports various signing algorithms:
Symmetric (Shared Secret):
Asymmetric (Public/Private Key):
#
1. Always use HTTPS - Never transmit JWT over plain HTTP 2. Set expiration - Always include exp claim 3. Use strong algorithms - Prefer RS256 or ES256 over HS256 for distributed systems 4. Store securely - Store JWT in HttpOnly, Secure cookies or local storage 5. Validate all claims - Don't trust the token blindly 6. Use short-lived tokens - Combine with refresh tokens
#
Refresh tokens are used to obtain new access tokens:
1. User authenticates with username/password 2. Server returns access token (short-lived) and refresh token (long-lived) 3. When access token expires, client uses refresh token to get new access token 4. Refresh tokens should be stored securely
#
JWT is stateless by design, which makes revocation challenging:
JWT is primarily used for authentication and information exchange in web applications.
JWT can be secure if properly implemented. Always use HTTPS and validate all claims.
JWT is signed, not encrypted. The payload is base64-encoded, not encrypted.
JWT is a token format, while OAuth is an authorization framework.
Access tokens should be short-lived (15-60 minutes), while refresh tokens can be longer-lived.
JWT is stateless, so revocation requires additional mechanisms like blacklists or short expiration times.
Store JWT in HttpOnly, Secure cookies for web applications.
Use RS256 or ES256 for distributed systems. Use HS256 only for single-server applications.
Try our tools to apply what you have learned in real-time.