What is JSON Web Token (JWT)?

Definition

JWT

What is JSON Web Token?

A JSON Web Token is a signed, self-contained token carrying claims about a user, used to authenticate API requests without server-side session state. Its security depends entirely on verifying the signature and algorithm.

A compact, self-contained token format used to transmit claims between parties as a digitally signed JSON object, widely used for API authentication and single sign-on flows. JWT vulnerabilities, including acceptance of the "none" algorithm, weak HMAC signing secrets, missing signature validation, and algorithm confusion attacks, frequently allow attackers to forge tokens and impersonate any user. Secure JWT implementations use asymmetric algorithms such as RS256 or ES256 and validate all claims on every request.

Related terms

OAuth 2.0 →

An authorization framework that allows applications to obtain limited delegated access to user accounts on third-party services without requiring users to share their passwords.

Authentication →

The process of verifying the identity of a user, device, or system before granting access to a resource.

API Security →

A set of practices and controls designed to protect application programming interfaces (APIs) from unauthorized access, misuse, and attacks.

Broken Authentication →

A class of vulnerabilities that allows attackers to compromise passwords, keys, or session tokens, or exploit implementation flaws to assume other users' identities.

Put this into practice

API security testing automation →

See how Penetrify's autonomous AI agents find and validate this class of security issue in your application.