What is JWT (JSON Web Token) Security?
JWTs are tokens used for authentication — they contain encoded user data and a signature to verify authenticity. Misusing them creates serious security vulnerabilities.
In plain English
A JWT is like a signed ID card. It contains your name and role, and it's signed by the authority that issued it. Anyone can read the card (it's not encrypted by default), but only the issuer can create a valid signature. If someone steals the card, they can impersonate you until it expires.
How JWTs work
When a user logs in, the server creates a JWT containing user data (ID, email, role) and signs it with a secret key. The token is sent to the client and included in subsequent requests. The server verifies the signature to confirm the token is legitimate and hasn't been tampered with. The token is self-contained — the server doesn't need to look up a session in the database.
Common JWT mistakes
Storing JWTs in localStorage (vulnerable to XSS — use httpOnly cookies instead). Not setting expiration times (tokens that never expire are dangerous if stolen). Using weak secrets (easily guessable signing keys). Not validating the token algorithm (attackers can change the algorithm to 'none'). Storing sensitive data in the payload (JWTs are Base64-encoded, not encrypted — anyone can read them).
Best practices
Store tokens in httpOnly, Secure, SameSite cookies. Set short expiration times (15 minutes to 1 hour) with refresh tokens for longer sessions. Use strong, random secrets (256+ bits). Always validate the algorithm on the server side. Don't store sensitive data in the payload. Implement token revocation for critical scenarios (password changes, account compromise).
Frequently asked questions
Should I use JWTs or sessions?
For most apps: sessions are simpler and more secure. JWTs are useful for stateless APIs, microservices, or when you need to avoid server-side session storage. If your app is a standard web app with a single backend, sessions are usually the better choice. Services like Supabase and NextAuth handle this decision for you.
Check your app
Get a professional review of your app at a fixed price.
Security Scan
Black-box review of your public-facing app. No code access needed.
- OWASP Top 10 checks
- SSL/TLS analysis
- Security headers
- Expert review within 24h
Code Audit
In-depth review of your source code for security, quality, and best practices.
- Security vulnerabilities
- Code quality review
- Dependency audit
- AI pattern analysis
Complete Bundle
Both scans in one package with cross-referenced findings.
- Everything in both products
- Cross-referenced findings
- Unified action plan
100% credited toward any paid service. Start with an audit, then let us fix what we find.
Worried about jwt (json web token) security in your app?
Get a professional code audit ($19) or book a free call to discuss your concerns.