What a JWTWhat is jwt?JSON Web Token - a self-contained, signed token that carries user data (like user ID and role). The server can verify it without a database lookup. Ask AI for more actually is

A JWT is three Base64URL-encoded JSONWhat is json?A text format for exchanging data between systems. It uses key-value pairs and arrays, and every programming language can read and write it. Ask AI for more objects joined by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.   ← Header  (algorithm + token type)
eyJ1c2VySWQiOjQyLCJyb2xlIjoidXNlciJ9.    ← Payload (claims: userId, role, expiry…)
SflKxwRJSMeKKF2QT4fwpMe...                 ← Signature (HMAC of header + payload)

The header and payloadWhat is payload?The data sent in the body of an HTTP request, such as the JSON object you include when creating a resource through a POST request. Ask AI for more are just Base64, anyone can decode and read them. The signature is what makes tampering detectable. When the server receives a tokenWhat is token?The smallest unit of text an LLM processes - roughly three-quarters of a word. API pricing is based on how many tokens you use. Ask AI for more it re-computes the signature using the secret key and compares it to the one in the token. If they match, the payload is trustworthy. If someone modified the payload (say, changing their role from "user" to "admin"), the signatures won't match and the token is rejected.

You can inspect any JWT at jwt.io.

Generating and verifying tokens

npm install jsonwebtoken

import jwt from 'jsonwebtoken';

const JWT_SECRET = process.env.JWT_SECRET;
const JWT_EXPIRES_IN = '15m';     // Access token: intentionally short
const REFRESH_EXPIRES_IN = '7d';  // Refresh token: longer lived

function generateTokens(user) {
  const accessToken = jwt.sign(
    { userId: user.id, role: user.role },
    JWT_SECRET,
    { expiresIn: JWT_EXPIRES_IN }
  );

  const refreshToken = jwt.sign(
    { userId: user.id, type: 'refresh' },
    JWT_SECRET,
    { expiresIn: REFRESH_EXPIRES_IN }
  );

  return { accessToken, refreshToken };
}

// Login endpoint
app.post('/auth/login', async (req, res) => {
  const { email, password } = req.body;

  const user = await db.findUserByEmail(email);
  if (!user || !await verifyPassword(password, user.passwordHash)) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  const tokens = generateTokens(user);

  // Persist the refresh token so we can revoke it later if needed
  await db.saveRefreshToken(user.id, tokens.refreshToken);

  res.json({
    accessToken: tokens.accessToken,
    refreshToken: tokens.refreshToken,
    expiresIn: 900  // 15 minutes in seconds
  });
});

// Middleware: verify access token on every protected request
function requireAuth(req, res, next) {
  const authHeader = req.headers.authorization;

  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Token required' });
  }

  const token = authHeader.substring(7); // strip "Bearer "

  try {
    const decoded = jwt.verify(token, JWT_SECRET);
    req.userId = decoded.userId;
    req.userRole = decoded.role;
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid or expired token' });
  }
}

The try/catch around jwt.verify() is not optional, the library throws on an invalid or expired tokenWhat is token?The smallest unit of text an LLM processes - roughly three-quarters of a word. API pricing is based on how many tokens you use. Ask AI for more. Without it, an unhandled error crashes the request and leaks stack traces to the client.

The refresh tokenWhat is refresh token?A long-lived credential used solely to obtain new short-lived access tokens without requiring the user to log in again. Ask AI for more pattern

Access tokens expire in minutes. That's the point, if one gets stolen, the damage window is short. But you don't want users to log in again every 15 minutes. Refresh tokens solve this: they live longer (days or weeks) and are used exclusively to get new access tokens.

app.post('/auth/refresh', async (req, res) => {
  const { refreshToken } = req.body;

  if (!refreshToken) {
    return res.status(401).json({ error: 'Refresh token required' });
  }

  try {
    const decoded = jwt.verify(refreshToken, JWT_SECRET);

    // Confirm the token hasn't been revoked
    const storedToken = await db.findRefreshToken(decoded.userId);
    if (storedToken !== refreshToken) {
      return res.status(401).json({ error: 'Invalid refresh token' });
    }

    const user = await db.findUserById(decoded.userId);
    const tokens = generateTokens(user);

    // Rotate: replace old refresh token with new one
    await db.saveRefreshToken(user.id, tokens.refreshToken);

    res.json(tokens);
  } catch (err) {
    return res.status(401).json({ error: 'Invalid refresh token' });
  }
});

TokenWhat is token?The smallest unit of text an LLM processes - roughly three-quarters of a word. API pricing is based on how many tokens you use. Ask AI for more rotation (issuing a new refresh token on every refresh) is a security best practice. If a refresh token is stolen and used, the legitimate user's next refresh attempt will fail, alerting you to a potential compromise.

Sending tokens from the client

// After login, store the tokens
localStorage.setItem('accessToken', response.accessToken);
localStorage.setItem('refreshToken', response.refreshToken);

// Attach the access token to every API request
fetch('/api/protected', {
  headers: {
    'Authorization': `Bearer ${localStorage.getItem('accessToken')}`
  }
});

// Intercept 401s and refresh automatically
async function fetchWithAuth(url, options = {}) {
  let token = localStorage.getItem('accessToken');

  let response = await fetch(url, {
    ...options,
    headers: { ...options.headers, 'Authorization': `Bearer ${token}` }
  });

  if (response.status === 401) {
    const newToken = await refreshAccessToken();
    response = await fetch(url, {
      ...options,
      headers: { ...options.headers, 'Authorization': `Bearer ${newToken}` }
    });
  }

  return response;
}

The code above uses localStorage for simplicity, but HttpOnlyWhat is httponly?A cookie flag that prevents JavaScript from reading the cookie. It stops XSS attacks from stealing session tokens or authentication cookies. Ask AI for more cookies are more secure for web apps, JavaScript cannot read them, so a successful XSSWhat is xss?Cross-Site Scripting - an attack where malicious JavaScript is injected into a web page and runs in other users' browsers, stealing data or hijacking sessions. Ask AI for more attack cannot steal the tokenWhat is token?The smallest unit of text an LLM processes - roughly three-quarters of a word. API pricing is based on how many tokens you use. Ask AI for more. localStorage is acceptable if you have a robust Content Security PolicyWhat is content security policy?An HTTP header that tells the browser which sources of scripts, styles, and other resources are allowed to load on your page, blocking unauthorized code. Ask AI for more and your app has a low XSS risk surface.

Sessions vs. JWTWhat is jwt?JSON Web Token - a self-contained, signed token that carries user data (like user ID and role). The server can verify it without a database lookup. Ask AI for more: choosing the right tool

Neither approach is universally better. The right choice depends on your architecture.

Use sessions when you're building a traditional server-rendered web app and need instant logout or account revocation. Use JWTs when you're building an APIWhat is api?A set of rules that lets one program talk to another, usually over the internet, by sending requests and getting responses. Ask AI for more consumed by mobile clients, SPAs on a different domain, or a microservicesWhat is microservices?An architecture where an application is split into small, independently deployed services that communicate over the network, each owning its own data. Ask AI for more architecture where statelessness is a design requirement.