JWT
JSON Web Token. A compact, URL-safe method for securely transmitting information between parties as a signed JSON object.
Detailed Explanation
JWTs are the most common token format for web authentication. A JWT consists of three parts: a header (specifying the signing algorithm), a payload (containing claims like user ID, roles, and expiration), and a signature (ensuring the token hasn't been tampered with).
When a user logs in, the server creates a JWT and sends it to the client. The client stores it (usually in a cookie or local storage) and includes it in the Authorization header of subsequent requests. The server verifies the signature without needing to look up the token in a database, making JWTs stateless and scalable. However, because they are stateless, you cannot revoke a JWT before it expires without additional mechanisms like token blacklisting.
Why It Matters
JWT is the industry standard for stateless authentication in modern web applications, used by virtually every major tech company.
Real-World Example
When you log into a SaaS app, the server issues a JWT containing your user ID and permissions. Every API call you make includes this JWT in the header, allowing the server to authenticate you without a database lookup.
When to Use
For stateless authentication in APIs, especially when you need to scale horizontally across multiple servers without shared session storage.
Advantages
- Stateless: no server-side session storage needed
- Self-contained: carries all user information
- Scalable across multiple servers
- Works across different domains and services
- Compact and URL-safe for HTTP headers
Disadvantages
- Cannot be revoked before expiration without extra mechanisms
- Payload is readable (base64-encoded, not encrypted)
- Larger than session IDs
- Token size grows with claims
- Complexity of proper implementation and key management
Related Terms
Frequently Asked Questions
Is JWT secure?
JWTs are secure when properly implemented. Always use HTTPS, validate the signature, check expiration, and use strong signing keys. Never store sensitive data in the payload since it is only base64-encoded, not encrypted.
Should I store JWT in cookies or local storage?
HTTP-only cookies are generally more secure because they are not accessible via JavaScript, protecting against XSS attacks. Local storage is easier but more vulnerable to XSS. Avoid storing JWTs in local storage for sensitive applications.
How long should a JWT last?
Short-lived tokens (15 minutes to 1 hour) are recommended for access tokens. Use refresh tokens (longer-lived) to obtain new access tokens without requiring the user to log in again.
What is the difference between JWT and session tokens?
JWTs are stateless and self-contained—the server can validate them without looking up session data. Session tokens are random strings that reference server-side session data. JWTs scale better; sessions are easier to revoke.
Can JWT be encrypted?
Yes. JWE (JSON Web Encryption) encrypts the JWT payload so only the intended recipient can read it. However, most applications use JWS (signed but not encrypted) because the payload typically doesn't contain secrets.