JWT Guides
Technical guides to JSON Web Tokens, written for developers who need a working answer: how tokens are built and verified, why a token is being rejected, how to implement JWT authentication in your framework, and how to keep it secure. Each guide links to the JWT decoder, which runs entirely in your browser.
Fundamentals
What a JWT is, how its three parts fit together, and what verification actually proves.
What is a JWT?
The complete introduction to JSON Web Tokens — what they are, how they work, and when to use them.
Header, Payload & Signature
Deep dive into each of the three JWT segments, including Base64url encoding and what each field means.
JWT Claims Explained
A complete reference for all seven standard registered claims — iss, sub, aud, exp, nbf, iat, jti — with practical guidance.
Verification Guide
How JWT signature verification works, including HMAC vs asymmetric algorithms, JWKS, and what verification actually proves.
Decoder vs Validator
Understand the critical difference between decoding, verification, claim validation, and full authorization enforcement.
JWTs in OAuth 2.0 & OIDC
How JWTs function within OAuth 2.0 and OpenID Connect — ID tokens, access tokens, JWKS, discovery, and major provider token shapes.
Decode a JWT Without a Server
How to decode and verify a JWT entirely in your browser via the Web Crypto API — no upload, no telemetry. The privacy-first way to inspect production tokens.
Debugging & Code
Tracking down rejected tokens and decoding or verifying JWTs in code.
Common JWT Errors & Fixes
Fix malformed tokens, invalid signatures, expired tokens, wrong audience/issuer errors, and clock skew issues.
Decode & Verify JWT in Code
Working code examples for decoding and verifying JWTs in JavaScript, Python, and Go — from raw Base64url to production-ready verification.
How to Debug a JWT
A step-by-step routine for 401 and 403 errors: capture the real token, check alg, kid, exp, iss and aud, then verify the signature.
Algorithms
Choosing and implementing HS256, RS256, ES256 and PS256, and the algorithm pitfalls to avoid.
HS256 vs RS256
When to use a shared secret vs a public/private key pair, and how the choice affects your security architecture.
ES256 Explained
ECDSA with P-256 and SHA-256 — the modern asymmetric JWT algorithm. Signature format, key sizes, and why it beats RS256 for greenfield systems.
PS256 vs RS256
RSA-PSS padding versus PKCS#1 v1.5 — same key pair, different security properties. Migration guidance and the algorithm-confusion pitfall both share.
The "none" Algorithm Vulnerability
The 2015 JWT none-algorithm attack: how libraries shipped vulnerable defaults, the confusion variant that followed, and the universal defence every verifier must apply.
Concepts & Claims
Individual claims and headers in depth: expiry, audience, scopes, roles, kid and JWKS.
What Is JWKS?
JSON Web Key Sets explained: JWK fields, jwks_uri discovery, caching, rotation, JWK-to-PEM and verification code.
JWT Scopes vs Roles
Scopes vs roles in JWTs: the scope and scp claims, roles and permissions claims by provider, naming conventions and RBAC design.
The JWT kid Header
What the kid key ID means, why it is a header not a claim, value formats, JWKS lookup, key rotation and kid injection defences.
JWT Expiration Time
The exp, iat and nbf claims, seconds vs milliseconds, expiresIn units by library, OAuth expires_in, lifetimes, plus a timestamp converter.
JWT aud Claim
What the audience claim means, string vs array values, aud vs sub, iss and azp, audience validation in code and fixing invalid audience.
Keys & Tooling
Generating secrets and key pairs, and working with JWTs from the command line, curl and Postman.
JWT Size Limit
No size limit in RFC 7519, but nginx, Apache, Node.js, AWS and cookies impose one. Calculate token size and shrink it.
JWT Secret Key Generator
Generate a random HS256, HS384 or HS512 secret in your browser, and learn the RFC 7518 minimum size and CLI commands.
JWT With curl and Postman
Send a JWT bearer token with curl or --oauth2-bearer, set up Postman Bearer Token and JWT Bearer auth, and fix 401s.
Generate JWT Signing Keys With OpenSSL
OpenSSL commands for RS256, ES256 and Ed25519 key pairs, PKCS#1 vs PKCS#8 conversion, and a Node.js sign-and-verify test.
Decode JWT From the Command Line
Tested bash, jq, PowerShell and Python one-liners that handle base64url padding, plus the jwt-cli and step CLI tools.
Comparisons
How JWTs relate to OAuth, SAML, API keys, bearer tokens, sessions and encrypted tokens.
JWT vs Session Tokens
How to choose between stateless JWTs and server-side sessions — revocation, scaling, storage, and the hybrid approach.
jwt.io Alternative
A factual comparison of jwtdecode.app and jwt.io: what is the same, what differs, and when each is the better tool.
JWT vs SAML
SAML XML assertions versus JWT and OpenID Connect ID tokens for single sign-on: format, signatures, flows and where each is used.
JWT vs OAuth
Why OAuth is an authorisation framework and JWT a token format, plus JWT vs opaque access tokens and introspection.
JWT vs Bearer Token
Bearer describes how a token is used, JWT what it contains: Bearer auth, RFC 6750 errors, the JWT bearer grant and DPoP.
JWT vs API Key
Static API keys versus short-lived signed JWTs: revocation, validation cost, security, and exchanging a key for a JWT.
Is a JWT Encrypted? JWS vs JWE
Why most JWTs are signed not encrypted, how JWE's five parts and alg/enc work, and when a nested signed-then-encrypted JWT fits.
Framework Guides
Implementing JWT authentication in Node.js, Next.js, FastAPI, Django, Spring Boot and ASP.NET Core.
JWT Authentication in Spring Boot
Spring Security's OAuth2 Resource Server for Boot 4 and 3: starter, issuer-uri, role mapping, NimbusJwtEncoder and jjwt.
JWT Authentication in Node.js & Express
Sign and verify JWTs with jsonwebtoken or jose, write Express auth middleware, and validate RS256 tokens via JWKS.
JWT Authentication in Next.js
App Router JWT auth with jose: HttpOnly cookies via cookies(), proxy.ts (formerly middleware.ts), route handlers and server actions.
JWT Authentication in FastAPI
FastAPI JWT auth with PyJWT, Argon2 via pwdlib and OAuth2PasswordBearer, plus JWKS verification and WebSocket tokens.
JWT Authentication in Django REST Framework
Simple JWT setup for DRF: settings, token URLs, refresh rotation, blacklist logout, React clients and Django Ninja.
JWT Authentication in ASP.NET Core
AddJwtBearer for .NET 8 to 10 Web APIs: validation parameters, roles and MapInboundClaims, dotnet user-jwts, refresh and logout.
Identity Providers
Validating tokens issued by AWS Cognito and Microsoft Entra ID.
Validate Azure Entra ID JWTs
Validate Azure AD / Entra ID access tokens: v1 vs v2 issuers, aud, oid vs sub, scp vs roles, JWKS discovery and APIM policies.
Validate AWS Cognito JWTs
Verify Cognito ID and access tokens: JWKS URL, issuer formats, token_use, aud vs client_id, aws-jwt-verify and API Gateway.
Security & Architecture
Attacks, storage, refresh, logout and revocation, WebSockets and microservices.
Security Best Practices
Token lifetime, storage, audience/issuer validation, key rotation, algorithm confusion attacks, and common implementation mistakes.
JWT Storage: localStorage vs Cookie
localStorage, sessionStorage, HttpOnly cookies, in-memory variables — the XSS and CSRF tradeoffs of each, and the hybrid pattern most modern apps end up with.
Refresh Token Pattern
Short-lived access tokens plus long-lived refresh tokens — rotation, replay detection, family revocation, and the implementation pitfalls that break the flow.
WebSocket JWT Authentication
Authenticating a WebSocket with a JWT when the browser can't set headers: cookies, first message, subprotocol trick and ticket exchange.
JWT Logout & Revocation
How to invalidate a JWT before it expires: short access tokens, revocable refresh tokens, a Redis jti denylist and token versioning.
JWT in Microservices
Gateway vs per-service validation, token propagation vs RFC 8693 exchange, mTLS/SPIFFE, per-service audiences and JWKS caching.
JWT Attacks & Vulnerabilities
alg none, algorithm confusion, weak secrets, kid/jku injection, psychic signatures and token leakage, with a test and a fix for each.