Glossary · Web & App Development
JWT
Overview
What a JWT is
A JWT is a self-contained token that carries a set of claims—statements about a user or session, such as a user ID, roles, and an expiration time. It is defined by RFC 7519 and encoded as three dot-separated segments: a header describing the signing algorithm, a payload holding the claims, and a signature.
The header and payload are Base64URL-encoded JSON, so they are readable but not encrypted by default. The signature is what makes the token trustworthy: it proves the token was issued by a party holding the secret or private key and has not been altered.
How JWTs work in authentication
After a user logs in, the server creates a JWT, signs it with a secret (HMAC) or a private key (RSA/ECDSA), and returns it to the client. The client sends the token on each subsequent request, typically in an Authorization: Bearer header. The server verifies the signature and expiration to authorize the request without a database lookup.
Because the token is self-verifying, JWTs scale well across stateless services and APIs. Common patterns pair a short-lived access token with a longer-lived refresh token to balance security and user convenience.
Security best practices and caveats
JWTs are signed, not encrypted, so never store passwords or sensitive secrets in the payload—anyone can decode it. Always set a short expiration, validate the algorithm on the server, and reject the 'none' algorithm to avoid signature-bypass attacks.
Revoking a stateless JWT before it expires is hard, so many teams keep a token blocklist or use short lifetimes with refresh tokens. For session-heavy apps where instant logout matters, traditional server sessions or a managed identity provider like Auth0 or Clerk may be a better fit.
Where we use it
Related Zen in Tech services
How our team puts JWT to work in real projects.
FAQ
JWT — common questions
Is a JWT encrypted?
No—a standard JWT is signed but not encrypted. The header and payload are only Base64URL-encoded, so anyone with the token can decode and read the claims. Use HTTPS in transit and, if you must hide the payload, use encrypted JWTs (JWE).
Where should I store a JWT on the client?
Store it where it is least exposed to XSS and CSRF. An HttpOnly, Secure cookie protects against script access; if you use localStorage for convenience, you must guard carefully against cross-site scripting.
What is the difference between a JWT and a session?
A JWT is stateless—the server verifies it by signature without storing anything—while a traditional session stores state server-side and hands the client an opaque ID. JWTs scale more easily; sessions make instant revocation simpler.
Need JWT done right?
Book a free consultation and we’ll map the fastest, most cost-effective path for your project.
Knowledge hub
From our knowledge hub
All articles →How to Reduce AI Voice Agent Latency
How to cut AI voice agent latency to sub-second, human-like turn-taking: where lag comes from (STT, LLM, TTS, network) and the fixes that actually work.
Read · 7 min →AI AutomationAutomating Lead Follow-Up and Onboarding for Coaches and Agencies
Follow-up automation for coaches and agencies: respond to leads in minutes, qualify prospects before calls, and automate onboarding so you focus on clients.
Read · 6 min →Web DevelopmentThe Auto Repair & Dealership Website That Books More Jobs
Auto repair and dealership websites that convert: online booking, fast mobile pages, reviews, and service pages that turn visitors into booked jobs.
Read · 4 min →