JWT Security Best Practices for Web Applications

JSON Web Tokens (JWTs) are the dominant standard for stateless authentication in modern web applications. They're used by OAuth 2.0, OpenID Connect, and countless APIs. However, JWTs are frequently misused, leading to serious security vulnerabilities. This guide covers the essential security practices every developer should follow.

How JWTs Work

A JWT consists of three parts separated by dots: Header, Payload, and Signature. The header specifies the signing algorithm. The payload contains claims (user ID, roles, expiration time). The signature verifies the token hasn't been tampered with.

Critically, JWTs are encoded, not encrypted. Anyone who intercepts a JWT can read its contents — the signature only prevents modification, not reading. Never put sensitive data (passwords, credit card numbers) in a JWT payload.

Token Storage: Where to Keep JWTs

This is the most debated topic in JWT security:

• localStorage — Convenient but vulnerable to XSS attacks. Any JavaScript on your page can read it.
• Cookies (HttpOnly, Secure, SameSite) — Immune to XSS but requires CSRF protection. The recommended approach for web applications.
• In-memory — Most secure against XSS and CSRF, but tokens are lost on page refresh. Works well with refresh token rotation.

Expiration and Refresh Strategy

Short-lived access tokens (5–15 minutes) combined with longer-lived refresh tokens is the industry standard. When the access token expires, the client uses the refresh token to get a new one. Refresh tokens should be single-use (rotated) and stored securely (HttpOnly cookie).

Algorithm Confusion Attacks

One of the most dangerous JWT vulnerabilities: an attacker changes the algorithm from RS256 (asymmetric) to HS256 (symmetric) and signs with the public key. Always validate the algorithm server-side and reject unexpected values. Never accept "alg": "none".

Claims to Always Include

• exp — Expiration time. Always set this.
• iat — Issued at. Helps detect token age.
• iss — Issuer. Verify the token came from your server.
• aud — Audience. Prevents tokens meant for one service from being used at another.
• sub — Subject (usually user ID). The primary identifier.

Common Mistakes to Avoid

• Using JWTs for session management when server-side sessions would be simpler
• Setting token expiration too long (days or weeks)
• Not validating the token signature on every request
• Storing sensitive data in the payload
• Not having a token revocation strategy

Inspect your JWT tokens with our JWT Decoder — decode and verify tokens entirely in your browser, no data sent to any server.