The Complete Guide to JSON Web Tokens (JWT) in 2026

What is JSON Web Token (JWT)?

A JSON Web Token (JWT) is a compact, URL-safe token used to securely transmit information between parties as a digitally signed JSON object. JWT enables stateless authentication, meaning the server does not need to store session data.

JWT is commonly used for:

• User authentication
• API authorization
• Secure service-to-service communication
• OAuth 2.0 and OpenID Connect flows

JWT structure explained

A JWT consists of three parts separated by dots: header.payload.signature. Each section is Base64Url encoded.

How JWT authentication works

1. User logs in.
2. Server verifies credentials.
3. Server generates and signs a JWT.
4. Client stores the token (HTTP-only cookie recommended).
5. Client sends token in Authorization: Bearer <token>.
6. Server verifies token before responding.

JWT implementation examples

Below are minimal, production-ready examples. Keep secrets in env vars, not code.

npm install express jsonwebtoken dotenv

const jwt = require('jsonwebtoken');

const payload = {
  userId: 123,
  role: "admin"
};

const token = jwt.sign(payload, process.env.JWT_SECRET, {
  expiresIn: "15m"
});

console.log(token);

function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];

  if (!token) return res.sendStatus(401);

  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.sendStatus(403);
    req.user = user;
    next();
  });
}

pip install pyjwt flask

import jwt
import datetime

payload = {
    "user_id": 123,
    "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=15)
}

token = jwt.encode(payload, "your_secret_key", algorithm="HS256")
print(token)

try:
    decoded = jwt.decode(token, "your_secret_key", algorithms=["HS256"])
    print(decoded)
except jwt.ExpiredSignatureError:
    print("Token expired")
except jwt.InvalidTokenError:
    print("Invalid token")

<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt-api</artifactId>
  <version>0.11.5</version>
</dependency>

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import java.util.Date;

String token = Jwts.builder()
        .setSubject("123")
        .claim("role", "admin")
        .setIssuedAt(new Date())
        .setExpiration(new Date(System.currentTimeMillis() + 900000))
        .signWith(SignatureAlgorithm.HS256, "your_secret_key")
        .compact();

System.out.println(token);

Jwts.parser()
    .setSigningKey("your_secret_key")
    .parseClaimsJws(token)
    .getBody();

JWT vs session-based authentication

When should you use JWT?

• Building RESTful APIs
• Using microservices
• Creating mobile + web hybrid apps
• Implementing OAuth 2.0
• Designing stateless cloud-native systems

When not to use JWT

• You need instant logout without token tracking
• Your app is simple and monolithic
• You require strict centralized session control