JWT

Tokens, signatures, claims, and the things that go wrong with JWTs.

Designing JWT Claims: What Belongs in a Token and What Doesn't
A practical guide to claim design — the standard claims and how to validate them, why token bloat becomes a 431 outage, PII and privacy in a base64 payload, namespacing custom claims, and versioning a payload you can never fully migrate.
Jul 29, 20269 min read
JWTs vs Opaque Tokens: Stop Choosing Based on Vibes
The real trade-off is where authorization state lives and how fast it can change. A decision framework covering revocation latency, introspection, hybrid designs, and the failure modes each choice hands you.
Jul 27, 20268 min read
Rotating JWT Signing Keys Without Logging Everyone Out
How JWKS and the kid header make key rotation a non-event — the overlap window, caching and thundering herds, emergency revocation, and the specific mistakes that turn a routine rotation into an outage.
Jul 25, 20269 min read
JWT Explained for Developers
A JWT is three base64-encoded strings separated by dots. What's in them, how signatures actually work, why "stateless auth" is a half-truth, and the mistakes that keep showing up in production code.
May 8, 20267 min read

Explore other topics