JWT Authentication

Definition

JSON Web Tokens: A compact, URL-safe means of representing claims (user data) between two parties. The data is cryptographically signed by the server, allowing it to be verified without needing to query a database.

Explain Like I'm New

Instead of the server storing your login state in a database, the server gives you a mathematically sealed ID badge with your user ID written on it. You show the badge on every request. The server does math to verify the seal wasn't tampered with, and instantly knows who you are.

Real World Example

Microservices. The 'Auth Server' logs the user in and generates a JWT. The user takes that JWT and talks to the 'Video Server'. The Video Server doesn't need to talk to the Auth Server; it just verifies the JWT's cryptographic signature locally.

Common Use Cases

•Stateless APIs
•Mobile authentication
•Single Sign-On (SSO)

Architecture & Flow

Interactive Example

Console output will appear here...

Interview Questions

basic

Is the data payload inside a standard JWT encrypted and hidden from the user?

intermediate

If a JWT is stolen by a hacker, how can the server invalidate it?

Flash Cards

Question

Encrypted?

Click to reveal answer

Answer

No! It is just Base64 encoded. Anyone can decode it and read the data (like `userId` or `email`). It is SIGNED, not encrypted. The signature just proves the data hasn't been *altered*.

Question

How to invalidate?

Click to reveal answer

Answer

You generally can't easily. Because JWTs are stateless, the server doesn't keep a list of them. A stolen JWT remains valid until its built-in expiration date (`exp`) passes. This is why JWTs should have very short lifespans (e.g., 15 minutes), paired with a Refresh Token system.