🔑JWT

NEW

Also known as: JSON Web Token

A compact, URL-safe JSON-based token format for claims transmission.

DESCRIPTION

JSON Web Token (JWT) is an open standard (RFC 7519) for representing claims between parties using a compact, URL-safe format. JWTs are commonly signed (JWS) or encrypted (JWE), enabling stateless authentication and authorization. They power OAuth 2.0 and OpenID Connect flows and are used in APIs and microservices. Careful validation and short expiries are essential for security.

ALTERNATIVE DEFINITIONS

IETF (RFC 7519)

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties.

Formal standard emphasizing claims transfer and compactness.

Source

Auth0

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

Highlights security use and industry adoption.

Source

RELATED TERMS

OAuth 2.0 OpenID Connect JWS JWE Access Token Refresh Token Claims Issuer Audience Token Expiry

COMPETING TERMS

SAML PASETO

KNOWLEDGE AREAS

Data Security Software Engineering Cloud Infrastructure

TARGET AUDIENCE

Software Developer Security Architect Cybersecurity Engineer Application Administrator DevOps Engineer

EXTERNAL SOURCES

• Wikipedia - JSON Web Token
• IETF - JWT official specification
• OWASP - Security best practices for JWT

TOP QUESTIONS

How does JWT enable stateless authentication?

JWTs encapsulate claims signed by an issuer, allowing services to validate tokens without storing session state, enabling horizontally scalable architectures.

Category: Definition

What are common JWT security pitfalls?

Accepting tokens with “none” algorithm, weak keys, long expirations, missing audience/issuer checks, and failing to rotate keys are major risks.

Category: Mistakes

What is currently a hot topic around JWT?

Short-lived tokens with OAuth 2.0, proof-of-possession tokens, and moving to PASETO for cryptographic safety are debated.

Category: Topic

How do JWS and JWE relate to JWT?

JWS signs JWTs to ensure integrity; JWE encrypts JWTs to protect confidentiality, often used together for sensitive claims.

Category: Definition

When should you use JWT vs opaque tokens?

Use JWT when services can validate locally and need embedded claims; opaque tokens fit centralized introspection and simpler rotation policies.

Category: Opinion

How do you validate a JWT correctly?

Verify signature, issuer, audience, expiry, not-before, and key identifiers; enforce algorithm and key constraints.

Category: Validation

What alternatives compete with JWT?

SAML assertions for enterprise SSO and PASETO as a safer token design are notable alternatives.

Category: Alternatives

How should claims be designed in JWT?

Keep minimal sensitive information, use standard registered claims (iss, sub, aud, exp), and include scoped roles or permissions thoughtfully.

Category: Requirements

How do refresh tokens complement JWT access tokens?

Short-lived access tokens reduce risk; refresh tokens secure long-term sessions with rotation and revocation strategies.

Category: Management