10 JWT Security Best Practices

From algorithm confusion attacks to leaked secrets, here are the JWT security pitfalls that show up in real production incidents — and how to avoid them.

1. Never accept `alg: none` Reject tokens with a "none" algorithm at the library level.

2. Pin the expected algorithm Don't trust the header. Configure your verifier with the exact algorithm you issued with — this prevents RS256 → HS256 confusion attacks.

3. Use ≥ 256-bit secrets for HMAC Anything shorter is brute-forceable offline with a leaked token.

4. Set short expirations Access tokens: 5–15 minutes. Use refresh tokens for longer sessions.

5. Store secrets in a secrets manager Never in `.env` files committed to git. Never in client-side code.

6. Validate `iss`, `aud`, and `exp` every time A signature check alone is not enough.

7. Rotate keys via `kid` and JWKS Plan for rotation from day one.

8. Don't put sensitive data in the payload JWTs are signed, not encrypted. Anyone can read the payload.

9. Use HTTPS everywhere A leaked token is a forged user.

10. Monitor for token reuse and anomalies Sudden token use from a new IP/UA is your earliest signal of compromise.

1. Never accept `alg: none` Reject tokens with a "none" algorithm at the library level.

2. Pin the expected algorithm Don't trust the header. Configure your verifier with the exact algorithm you issued with — this prevents RS256 → HS256 confusion attacks.

3. Use ≥ 256-bit secrets for HMAC Anything shorter is brute-forceable offline with a leaked token.

4. Set short expirations Access tokens: 5–15 minutes. Use refresh tokens for longer sessions.

5. Store secrets in a secrets manager Never in `.env` files committed to git. Never in client-side code.

6. Validate `iss`, `aud`, and `exp` every time A signature check alone is not enough.

7. Rotate keys via `kid` and JWKS Plan for rotation from day one.

8. Don't put sensitive data in the payload JWTs are signed, not encrypted. Anyone can read the payload.

9. Use HTTPS everywhere A leaked token is a forged user.

10. Monitor for token reuse and anomalies Sudden token use from a new IP/UA is your earliest signal of compromise.

Generate a JWT secret now

Related tools and reading