Awesome Open Source
Awesome Open Source


A demo to learn JWT by reverse engineering

How To Use It

Open in Gitpod

  1. Head over to the demo hosted on

Or run it on your local machine by cloning the repo and running following commands

#Install dependencies
npm install

#Create environment variables file
cp ENV_SAMPLE .env
#Defaults should work for local setup. But on production, env variables should be set for your server e.g. API_URL, FRONTEND_URL, etc.

npm start
#Visit localhost:3000
  1. Play around with the configurations
  2. Read the cues at every page with more resources to go deeper into concepts

Demo GIF


If you want to extend code for more functionalities, checkout the documentation


About Tokens


Invalidating JWT

  • Simply remove the token from the client
  • Create a token blacklist
  • Just keep token expiry times short and rotate them often
  • Contingency Plans : allow the user to change an underlying user lookup ID with their login credentials

A common approach for invalidating tokens when a user changes their password is to sign the token with a hash of their password. Thus if the password changes, any previous tokens automatically fail to verify. You can extend this to logout by including a last-logout-time in the user's record and using a combination of the last-logout-time and password hash to sign the token. This requires a DB lookup each time you need to verify the token signature, but presumably you're looking up the user anyway.

Securtity Risks


Other Useful Tools

Related Awesome Lists
Top Programming Languages

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Typescript (306,134
Express (32,864
Token (29,382
Authentication (27,101
Encryption (12,022
Cryptography (11,432
Jwt (10,347
Passport (4,245
Rsa (3,177
Reverse Engineering (2,599
Rfc 7519 (8