Understanding JSON Web Tokens (JWT)

What is a JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are compact, URL-safe tokens that contain claims about an entity (typically a user) and are digitally signed to ensure integrity. They've become the de facto standard for authentication in modern web applications and APIs.

JWT Structure

A JWT consists of three parts separated by dots (.):

• Header: Contains token type (JWT) and signing algorithm (e.g., HS256, RS256).
• Payload: Contains claims (statements about the user and additional metadata).
• Signature: Created by encoding the header and payload, then signing with a secret key.

JWT Claims

Claims are statements about an entity and additional data. There are three types:

• Registered Claims: Predefined claims like iss (issuer), exp (expiration), sub (subject), aud (audience).
• Public Claims: Custom claims that should be defined in the IANA JWT Registry or use collision-resistant names.
• Private Claims: Custom claims agreed upon by parties sharing the token.

Common JWT Claims

• iss (issuer): Identifies who issued the token.
• sub (subject): Identifies the subject of the token (usually the user ID).
• aud (audience): Identifies the intended recipients of the token.
• exp (expiration): Timestamp when the token expires (Unix timestamp).
• nbf (not before): Timestamp before which the token should not be accepted.
• iat (issued at): Timestamp when the token was issued.
• jti (JWT ID): Unique identifier for the token, used to prevent replay attacks.

Signing Algorithms

• HS256 (HMAC SHA-256): Symmetric algorithm using a shared secret. Fast and simple for server-to-server.
• RS256 (RSA SHA-256): Asymmetric algorithm using public/private key pairs. Better for distributed systems.
• ES256 (ECDSA SHA-256): Asymmetric algorithm with smaller keys and signatures than RSA.

JWT vs Session Authentication

JWT Advantages:

• Stateless - no server-side session storage needed
• Scalable - works across multiple servers without shared session store
• Cross-domain - can be used across different domains
• Mobile-friendly - easy to use in mobile apps

Session Advantages:

• Instant revocation - can invalidate sessions immediately
• Smaller size - session IDs are smaller than JWTs
• Server control - full control over session data

Security Best Practices

• Use Strong Secrets: Generate cryptographically secure random secrets (at least 256 bits for HS256).
• Short Expiration: Set short expiration times (15-60 minutes) and use refresh tokens for long-term access.
• HTTPS Only: Always transmit JWTs over HTTPS to prevent interception.
• Store Securely: In browsers, use httpOnly cookies or secure storage; never localStorage for sensitive tokens.
• Validate Everything: Always verify signature, expiration, issuer, and audience claims.
• Avoid Sensitive Data: Don't put sensitive information in the payload; JWTs are not encrypted by default.
• Implement Refresh Tokens: Use short-lived access tokens with longer-lived refresh tokens.
• Token Revocation: Implement a token blacklist or use short expiration times for better control.

Common Use Cases

• API Authentication: Authenticate users accessing RESTful APIs without maintaining server sessions.
• Single Sign-On (SSO): Share authentication across multiple applications and domains.
• Mobile Apps: Authenticate mobile applications without cookie-based sessions.
• Microservices: Pass user context between services without centralized session storage.
• OAuth 2.0: Used as access tokens in OAuth 2.0 authorization flows.

JWT Pitfalls to Avoid

• None Algorithm: Never accept tokens with "alg": "none" as they're not signed.
• Algorithm Confusion: Verify the algorithm matches expectations to prevent downgrade attacks.
• Missing Validation: Always validate exp, iss, and aud claims, not just the signature.
• XSS Vulnerabilities: If storing in localStorage, ensure your app is protected against XSS attacks.
• Token Size: JWTs can become large; monitor token size for performance impacts.

Using This Generator

This tool generates JWTs for testing and development. Enter your payload as JSON, provide a secret key, choose an algorithm, and set expiration time. The generator creates a complete JWT and displays its parts separately for inspection. Use this for API testing, learning JWT structure, or generating tokens for development environments.

Note: This is for educational and development purposes. In production, use established JWT libraries and follow security best practices.