LearnViz CompSci
Home / Learn / Web Development / JWT

Advanced Topic 38 of 51 Web Development

JWT

Signed tokens carrying claims between parties.

How it works

A JSON Web Token is a compact, URL-safe token with three Base64URL parts: a header naming the algorithm, a payload of claims such as subject, expiry and roles, and a signature made with a secret or private key. The server verifies the signature to trust the claims without a database lookup, which makes JWTs convenient for stateless APIs and single sign-on. Access tokens are short-lived and are paired with refresh tokens.

Step-by-step walkthrough

  1. A JWT has three base64 parts.
  2. The payload carries claims such as user id and expiry.
  3. The server signs header and payload with a secret or private key.
  4. Clients send the token in each request.
  5. The server verifies the signature, so it needs no session lookup, but cannot revoke easily.

Where it is used

API authentication, microservice-to-microservice calls, OpenID Connect ID tokens and mobile app sessions use JWTs.

Common pitfall

The payload is only encoded, not encrypted, so never put secrets in it. Accepting the none algorithm or confusing symmetric and asymmetric keys leads to forgery, so enforce expected algorithms. Revocation is hard because tokens stay valid until they expire. Storing them in local storage exposes them to XSS. Keep lifetimes short, validate every claim and rotate keys.

Where it fits in the course

JWT is topic 38 of 51 in Web Development, rated Advanced. It follows Authentication Flows. The next topic is OAuth 2.0.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Web Development quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is JWT?
Signed tokens carrying claims between parties. It belongs to Web Development and is an advanced-level topic.
Where do people use JWT?
API authentication, microservice-to-microservice calls, OpenID Connect ID tokens and mobile app sessions use JWTs.
What is the most common mistake with JWT?
The payload is only encoded, not encrypted, so never put secrets in it.
What should I learn before this topic?
Start with Authentication Flows, the topic just before it in Web Development.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Web Development quiz.
Is JWT hard to learn?
It is an Advanced topic. Expect to read the explanation more than once and to connect it with earlier topics. Working through a small example by hand helps most.
How long does it take to learn JWT?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to JWT?
Authentication Flows, OAuth 2.0, Express and Middleware are closely connected. The full list is in the related topics section of this page.
What should I study after JWT?
Continue with OAuth 2.0, the next topic in Web Development.

Related topics