Question 1

What is a JWT?

Accepted Answer

JWT (JSON Web Token, RFC 7519) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: header.payload.signature. JWTs are commonly used for authentication and information exchange in web APIs.

Question 2

What's the difference between HS256 and RS256?

Accepted Answer

HS256 (HMAC-SHA256) is symmetric — the same secret key signs and verifies the token, so both parties must share the secret. RS256 (RSA-SHA256) is asymmetric — a private key signs and a public key verifies, so the verifying party never needs the signing key. RS256 is preferred for distributed systems.

Question 3

How should I set the expiration (exp)?

Accepted Answer

The exp claim is a NumericDate — seconds since the Unix epoch (1970-01-01 UTC). Short-lived tokens (5-60 minutes) paired with refresh tokens are best practice. Never use long expirations for access tokens, and always include exp to prevent replay attacks.

Question 4

Are JWTs encrypted?

Accepted Answer

No. Standard JWTs (JWS) are signed but not encrypted — anyone who has the token can read its payload by Base64-decoding it. For confidentiality use JWE (JSON Web Encryption), or never put sensitive data in a JWT payload.

Question 5

Is my secret safe here?

Accepted Answer

Yes. Signing happens entirely in your browser via the Web Crypto API. Your secret or private key is never uploaded to any server. For real production secrets, prefer generating them in a secure backend.