JWT (JSON Web Tokens) have become a default choice for authentication and authorisation in modern systems.

They are widely adopted because they are:

Stateless

Scalable

Easy to integrate across services

But in real-world environments, especially distributed systems, JWT often introduces subtle security risks that are not immediately visible.

Most JWT implementations are cryptographically correct…

but architecturally flawed.

This post explains:

How JWT actually works

Where implementations go wrong

Real-world failure scenarios

How to design JWT usage securely

1. What JWT Really Is

A JWT is a signed token , not an encrypted one.

It guarantees:

Integrity (data hasn’t been modified)

Authenticity (issued by a trusted entity)

It does not guarantee:

Confidentiality

Correct usage across systems

Authorisation correctness

2.…