1. What is JWT?

JWT stands for JSON Web Token. It is a compact, self-contained way to securely transmit information between two parties — like a server and a client (your browser or mobile app).

Think of it like a digital ID card. When you log in to a website, the server gives you this token. You carry it with every future request, so the server knows who you are — without having to ask you to log in again.

Note : JWT is encoded, not encrypted. Anyone who has the token can read its contents — so never store sensitive data like passwords inside it.

2. Why do we use JWT?

Before JWT, most apps used sessions. The server stored your login state in a database. That works, but it does not scale well when millions of users are logged in.

JWT solves this with three key properties:

• Stateless — The server does not need to store anything. All information is inside the token itself.

• Self-contained — The token carries its own data and its own signature for verification.

• Compact — It is small in size, so it can be sent easily via HTTP headers or cookies.

Common use cases include:

• Authorization (stay logged in after refreshing the page)

• Information exchange between services

• Single Sign-On (SSO) — log in once, use multiple apps

3. The 3-Part Structure

A JWT looks like this:

eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiS2FscGVzaCJ9.xMp4_signature_here

you can genrate this key using this command :

node -e "console.log(require('crypto').randomBytes(32).toString('hex'));"

It has exactly 3 parts, separated by dots:

Part 1 : Header

Token type & signing algorithm (e.g. HS256)

Part 2 : Payload

Your actual data — user ID, role, expiry time

Part 3 : Signature

Proof the token was not tampered with

Each part is Base64URL encoded. The signature is generated using a secret key only the server knows. If anyone changes the payload, the signature breaks — and the server rejects the token.

4. How it actually works

Here is the simple flow:

1. User logs in with email + password.

2. Server verifies credentials and creates a JWT using jwt.sign().

3. Server sends the token to the client.

4. Client stores the token (more on where in the Precautions section).

5. For every future request, the client sends the token in the header.

6. Server verifies the token using jwt.verify() and reads the payload.

![](https://cdn.hashnode.com/uploads/covers/695771ceabd7802ad48d9f7f/5965091f-1179-4c8e-bfe2-69649e183a64.png align="middle")

jwt.sign() vs jwt.verify()

jwt.sign(payload, secret) creates a new token. jwt.verify(token, secret) checks if it is valid and returns the original payload.

5. Code Example (Node.js)

Install the library first:

npm install jsonwebtoken

Creating a token:

const jwt = require('jsonwebtoken');

const secret = process.env.JWT_SECRET; // store in .env, never hardcode

const payload = { id: 101, name: 'Kalpesh', role: 'user' };

const token = jwt.sign(payload, secret, { expiresIn: '1h' });

console.log(token); // send this to the client

Verifying a token:

try {
  const decoded = jwt.verify(token, secret);
  console.log(decoded); // { id: 101, name: 'Kalpesh', role: 'user', iat: ..., exp: ... }
} catch (err) {
  console.log('Invalid or expired token');
}

6. Access Token vs Refresh Token

Most real apps use two tokens together. Here is the difference:

The combination of both lets users stay logged in for days — without having to re-enter their password — while keeping the security window small.

7. Common Errors

JWT Malformed

Token does not follow the 3-part (header.payload.signature) format. Usually caused by a corrupt or incomplete token string.

Token Expired

The exp claim in the payload has passed. You need to issue a new access token using the refresh token.

Invalid Signature

Payload was tampered with, or the token was signed with a different secret. Always reject this immediately.

Invalid Algorithm

Token header says alg: none — a known attack. Always enforce the algorithm on your server side.

8. Security Precautions

JWT is powerful, but easy to misuse. Watch out for these:

1. Do not store tokens in localStorage : localStorage is accessible to any JavaScript running on your page. If there is an XSS vulnerability, attackers can steal the token. Use an HttpOnly Cookie instead — JavaScript cannot touch it.

2. Never trust the alg: none header : Some old libraries accepted tokens with no signature algorithm — meaning no verification at all. Always enforce a specific algorithm like HS256 or RS256 on your server.

3. Use strong, secret keys: Weak secrets like "password" or "secret123" can be cracked using common word lists. Use a long, random string stored in environment variables — never hardcoded in source code.

4. Do not include sensitive data in the payload: JWT is encoded, not encrypted. The payload can be decoded by anyone with the token. Never store passwords, credit card numbers, or private data inside it.

⚠️ Need encryption?

If you really must send sensitive information inside a token, use JWE (JSON Web Encryption) instead of plain JWT. JWE encrypts the payload so it is not readable without the private key.

9. Quick Recap

Everything you need to remember

• JWT = compact, self-contained token for authentication and information exchange.

• 3 parts: Header · Payload · Signature — all Base64URL encoded, separated by dots.

• JWT is encoded, not encrypted — never store sensitive data in it.

• Use jwt.sign() to create, jwt.verify() to validate.

• Access tokens are short-lived. Refresh tokens are long-lived and stored in HttpOnly cookies.

• Store tokens in HttpOnly cookies, never in localStorage.

• Always enforce the signing algorithm and use a strong secret key.

That is everything you need to get started with JWT. The best way to solidify this is to build a small login system yourself — create a token on login, verify it on protected routes, and refresh it when it expires. You will understand it deeply once you have done it hands-on.

Written by lalit gurjar · JWT Notes to Blog · March 2026

What is Git ?

Git is a distributed version control system (VCS).

Simply put, Git helps you track changes in your files (especially code) and manage different versions of a project.

• Every developer has a complete copy of the project on their own computer.

• You can save your progress, return to older versions, and try out new ideas safely.

• Git works on your computer, so you don’t need the internet for basic tasks.

Git was created by Linus Torvalds (the creator of Linux) to manage large codebases efficiently.

Why Git ?

Git is popular because it solves many real-world development issues:

• Version control: Keeps a record of changes and lets you go back to old versions.

• Collaboration: Many developers can work on the same project without messing up each other's work.

• Branching: Test new features or ideas without changing the main code.

• Backup: Your code history is safe even if something goes wrong.

• Industry standard: Works with platforms like GitHub, GitLab, and Bitbucket.

Basic Git and important key

a)Repository

A repository is a folder that Git keeps track of.
It includes:

• Your project files

• A hidden .git directory (holds Git history and information)

There are two kinds:

• Local repository: On your computer

• Remote repository: On servers like GitHub

b) Working Directory

The working directory is where you normally edit files, and changes are not tracked until you inform Git.c) Staging Area

d) Commit

A commit is a snapshot of your project at a specific time, with each commit having a unique ID (hash) and a message describing the change, acting like a save point.

e) Branch

A branch is a separate line of development, typically with the default branch being main or master, and is used to develop features or fix bugs independently.

f) HEAD

HEAD points to the current commit or branch you are working on.It tells Git where you are in the project history.

Common Git Commands :

git init // Initialize a Repository

git status // Check File Status

git add file.txt // Add Files to Staging Area

git add . // Add all Files to Staging Area

git commit -m "message" // Commit Changes

git log // View Commit History
git log --oneline // View oneliner Commit History

// Create and Switch Branch
    git branch feature 
    git checkout feature 
    git checkout -b feature

git diff // Check Differences

Git File Flow

Working Directory ----> Staging Area -----> Repository

Local Repository Structure

Project Folder
 |--> .git/
 |--> index.html
 |--> app.js
    ...

Commit History Flow

Commit A --> Commit B --> Commit C (HEAD)