JWT Authentication Explained

# JWT Authentication Explained A JSON Web Token (JWT) is a compact, signed piece of data used to prove a user's identity across requests without the server storing session state. ## The Three Parts A JWT has three base64-encoded segments separated by dots: `header.payload.signature`. ``` eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiIxMjMifQ.4f3a1b... ``` The **header** describes the signing algorithm, the **payload** holds claims (like user ID and expiry), and the **signature** proves the token hasn't been tampered with. ## Signing and Verifying ```javascript const jwt = require("jsonwebtoken"); const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET, { expiresIn: "1h", }); const decoded = jwt.verify(token, process.env.JWT_SECRET); ``` The signature is generated using a secret key only the server knows — this is what makes tampering detectable, not encryption of the payload itself. ## A Critical Misconception The payload is only encoded, not encrypted — anyone can decode a JWT and read its contents without the secret. Never put passwords or sensitive data in the payload. ## Expiry and Refresh Tokens Short-lived access tokens (15–60 minutes) limit damage if one is stolen. A longer-lived refresh token, stored more securely, is used to obtain a new access token without forcing the user to log in again. ## Common Security Mistakes Storing JWTs in `localStorage` exposes them to XSS attacks. HTTP-only cookies are generally safer since client-side JavaScript can't read them. ## Conclusion JWTs solve statelessness well, but they shift responsibility onto the developer to handle expiry, secure storage, and secret management correctly — they aren't automatically more secure than sessions.