What is a JSON Web Token (JWT)?
A JSON Web Token (JWT) is a signed pass your app gives a user after they log in. The user's browser sends it with every request, and your server reads it to know who is calling. It is signed, so it cannot be changed without the server noticing, but it is not hidden: anyone holding it can read what is inside.
Also called: JWT
ON THIS PAGE
What it means
A JWT has three parts: a header, the details (who the user is, when the token expires) and a signature. The signature is made with a secret only your server knows, so a forged or edited token fails the check.
The details are only encoded, not encrypted. Never put passwords or private data inside a token.
Why it matters for vibe-coded apps
Supabase, Firebase and most login libraries use JWTs behind the scenes. Problems appear when code reads them without checking the signature, or keeps them valid forever.
- A token that is read but never verified can be faked by anyone.
- A token that never expires gives a thief permanent access.
- A weak or leaked signing secret lets anyone make valid tokens for any user.
Example
A server function that works out who is calling.
const user = jwt.decode(token);const user = jwt.verify(token, process.env.JWT_SECRET, {
algorithms: ["HS256"],
});Give tokens a short life, such as 15 minutes to an hour, and refresh them with a separate token.
How to check if your app has this problem
- 1Search your code for jwt.decode and any place that reads a token without verifying it.
- 2Check the token expiry. Anything longer than a day deserves a second look.
- 3Make sure the signing secret is a long random value held in an environment variable, not in your code.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Always verify the signature on the server before trusting anything in a token.
- 2Set a short expiry and use refresh tokens for longer sessions.
- 3Keep the signing secret out of your code and out of the browser.
- 4If you use Supabase or Firebase Auth, let their libraries verify tokens for you.
Find every place in my project that reads a JWT. Make sure each one verifies the signature and expiry on the server (not just decodes it), restrict the allowed algorithms, and read the signing secret from an environment variable. Set access tokens to expire within an hour. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for JSON Web Token (JWT) issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- OAuthThe standard behind "Sign in with Google" and similar buttons.
- Environment variablesSettings stored outside your code, used to keep secrets out of it.
- Cross-site scripting (XSS)Someone sneaks code into your pages that runs in other users' browsers.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.