JWT (JSON Web Token)
Handed out at sign-in and sent back with every request, this signed token tells the server who is asking without a session lookup each time.
Updated October 2026 · with examples from our own builds
What does JWT mean in practice?
A JWT carries a small set of claims, such as the user's ID and when the token expires, signed by the server so it can't be altered without detection. Many web and mobile backends use them to keep people signed in.
The questions to ask are about expiry and revocation. A token that lives for months is convenient and risky, because a stolen one works until it expires unless the system has a way to cancel it. Short-lived tokens with a refresh step are the usual compromise.
JWT libraries are dependencies like any other, and they need upgrading when vulnerabilities are published.
JWT at a glance
- Carries
- Who the user is and when the token expires
- Main risk
- Long-lived tokens that can't be revoked
- Maintenance
- Keep the JWT library patched
Where has JWT come up in our builds?
The studio's backend authenticates with JWT and Passport. In the June 2026 dependency clean-up, jsonwebtoken moved from version 8 to 9 and passport from 0.4 to 0.7, and the two Passport lookups were rewritten with async/await after Mongoose 7 removed query callbacks.
Common questions about JWT
How long should a login token last?
Short enough that a stolen one is of limited use, with a refresh token that can be cancelled to keep people signed in. The right length depends on how sensitive the data is.
Can I sign someone out of every device if their phone is stolen?
Only if the system can revoke tokens, for example by cancelling refresh tokens or keeping a list of revoked ones. Ask whether your backend can do this before you need it.
Related terms
Sources
Planning a product and not sure where JWT fits? Ask us, or browse all 116 terms in the glossary.