What Is JWT? Complete Guide to JSON Web Tokens

What is a JWT?

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

JWTs are most commonly used for authorization. Once a user is logged in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources that are permitted with that token.

The "exp" Claim Explained

Within the payload (the middle section of the JWT), there are standard fields called "claims." The exp (Expiration Time) claim is one of the registered claims defined by the specification.

The exp claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. The processing of the exp claim requires that the current date/time MUST be before the expiration date/time listed in the token.

Unix Timestamps in JWTs

A very common source of bugs in JWT implementations relates to the unit of time used. The JWT specification explicitly requires the exp claim to be a NumericDate.

A NumericDate is defined as the number of seconds from the Unix Epoch (1970-01-01T00:00:00Z UTC) until the specified date/time. This ignores leap seconds.

Why Expiration is Critical

Unlike traditional session cookies, which the server can destroy at any time by deleting the session from its database, JWTs are stateless.

When a backend service receives a JWT, it does not query a database to check if the user is still active; it simply verifies the cryptographic signature. Therefore, if a hacker steals a JWT, they can impersonate the user until the token expires. This is why giving a JWT a lifespan of "1 year" is a massive security vulnerability.

Refresh Token Architectures

To solve the stateless vulnerability, modern architectures use a combination of two tokens:

• Access Token (JWT): Very short-lived (e.g., 15 minutes). Used for accessing resources.
• Refresh Token: Long-lived (e.g., 7 days) and stored securely (often as an HttpOnly cookie). Used exclusively to request new Access Tokens.

When the 15-minute Access Token expires, the client sends the Refresh Token to a specific endpoint. The server validates the Refresh Token against its database (checking if the user was banned or logged out), and if valid, issues a new short-lived Access Token.

Common Mistakes

• Ignoring Clock Skew: Different servers across a network might have slightly different system clocks. It's a best practice to allow a small leeway (e.g., 30-60 seconds) when validating the exp claim to prevent random failures.
• Using Milliseconds: As mentioned above, accidentally setting the expiry in milliseconds creates practically infinite tokens.

Security Best Practices

Implement these practices to harden your JWT architecture:

1. Keep Access Tokens short-lived (under 1 hour).
2. Never store sensitive data (like passwords or PII) inside the JWT payload. Anyone can read it.
3. Use strong, randomly generated secrets for HMAC signing (at least 256 bits).
4. Rotate your signing keys periodically.

Decoding JWTs in Code

Because the payload is simply Base64Url encoded, you can decode a JWT and read the exp claim natively without needing a heavy cryptographic library.

// Decode the middle part of the JWT
function getJwtExpiry(token) {
  const payload = token.split('.')[1];
  // Convert Base64Url to standard Base64
  const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
  const jsonPayload = decodeURIComponent(window.atob(base64).split('').map(function(c) {
      return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
  }).join(''));
  
  const { exp } = JSON.parse(jsonPayload);
  // Convert seconds to milliseconds for JS Date
  return new Date(exp * 1000); 
}

// Creating an exp claim 15 minutes from now
const nowInSeconds = Math.floor(Date.now() / 1000);
const exp = nowInSeconds + (15 * 60);

const payload = {
  userId: "123",
  exp: exp
};

Frequently Asked Questions