JWT Tokens in Java: Complete Guide to Working with JSON Web Tokens

JWT Tokens in Java: Complete Guide to Working with JSON Web Tokens

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way to transmit information between parties as a JSON object. In Java, there are several mature libraries for working with JWT that allow you to create, sign, verify, and decode tokens. In this article, we will take a detailed look at three main libraries: JJWT, Auth0 java-jwt, and Nimbus JOSE + JWT, and also cover best practices for their use.

What is JWT and why is it needed in Java?

JWT consists of three parts separated by dots:

• Header — contains information about the token type and signing algorithm (e.g., HS256 or RS256).
• Payload — contains claims: standard (iss, sub, exp, iat) and custom data.
• Signature — created by hashing the header + payload using a secret key or RSA/ECDSA key pair.

In Java, JWT is most often used for:

• Authentication and authorization in REST APIs (especially in conjunction with Spring Security).
• Transmitting information between microservices.
• Implementing Single Sign-On (SSO).

JJWT Library (io.jsonwebtoken)

JJWT is one of the most popular and well-documented libraries for Java. It supports all modern signing and encryption algorithms and provides a convenient fluent API.

Installation

<dependency>    <groupId>io.jsonwebtoken</groupId>    <artifactId>jjwt-api</artifactId>    <version>0.12.6</version></dependency><dependency>    <groupId>io.jsonwebtoken</groupId>    <artifactId>jjwt-impl</artifactId>    <version>0.12.6</version>    <scope>runtime</scope></dependency><dependency>    <groupId>io.jsonwebtoken</groupId>    <artifactId>jjwt-jackson</artifactId>    <version>0.12.6</version>    <scope>runtime</scope></dependency>

Creating JWT with JJWT

import io.jsonwebtoken.Jwts;import io.jsonwebtoken.SignatureAlgorithm;import io.jsonwebtoken.security.Keys;import javax.crypto.SecretKey;import java.util.Date;

public class JwtExample {    public static void main(String[] args) {        // Generate a secure key for HS256        SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256);

        String jwt = Jwts.builder()                .subject("user123")                .issuer("https://pythonlib.ru")                .issuedAt(new Date())                .expiration(new Date(System.currentTimeMillis() + 3600000)) // 1 hour                .claim("role", "ADMIN")                .signWith(key)                .compact();

        System.out.println("JWT: " + jwt);    }}

Verifying and Parsing JWT

import io.jsonwebtoken.Claims;import io.jsonwebtoken.Jws;import io.jsonwebtoken.Jwts;

public class JwtParser {    public static void main(String[] args) {        String jwt = "eyJhbGciOiJIUzI1NiJ9..."; // your token        SecretKey key = ...; // the same key used for signing

        try {            Jws<Claims> claimsJws = Jwts.parser()                    .verifyWith(key)                    .build()                    .parseSignedClaims(jwt);                        Claims claims = claimsJws.getPayload();            String subject = claims.getSubject();            String role = claims.get("role", String.class);                        System.out.println("Subject: " + subject);            System.out.println("Role: " + role);        } catch (Exception e)