jwt

name	JWT
slug	jwt
version	1.0.1
description	Implement secure JWT authentication with proper validation, token lifecycle, and key management.
metadata	{"clawdbot":{"emoji":"🔐","os":["linux","darwin","win32"]}}

Quick Reference

Topic	File
Algorithm selection	algorithms.md
Token lifecycle	lifecycle.md
Validation checklist	validation.md
Common attacks	attacks.md

Security Fundamentals

• JWTs are signed, not encrypted—anyone can decode and read the payload; never store secrets in it
• Always verify signature before trusting claims—decode without verify is useless for auth
• The alg: none attack: reject tokens with algorithm "none"—some libraries accepted unsigned tokens
• Use strong secrets: HS256 needs 256+ bit key; short secrets are brute-forceable

Algorithm Choice