Learn JSON Web Tokens

Accurate, no-fluff guides to JWTs for working developers:

• What is a JWT? — the three segments, signing vs encryption, JWS vs JWE
• Claims reference — all 69 registered, OIDC and vendor claims, each with its own page
• Registered, public & private claims — the RFC 7519 categories
• JWT algorithms — HS256 vs RS256 vs ES256 vs EdDSA
• JWT attacks — alg:none, algorithm confusion, kid injection and friends
• ID vs access vs refresh tokens
• JWT vs session cookies
• How to decode a JWT — JavaScript, Python, Java, Go
• Is it safe to paste a JWT online?
• FAQ