JWT Tokens in Java: Complete Guide to Working with JSON Web Tokens

JWT Tokens in Java: Creation, Verification, and Usage

JSON Web Token (JWT) is a compact and self-contained way to transmit information between parties as a JSON object. In Java, JWT is actively used for authentication, authorization, and data exchange in REST APIs and microservice architecture. In this article, we will cover the two most popular libraries for working with JWT in Java — JJWT (Java JWT) from Stormpath and java-jwt from Auth0, and also look at integration with Spring Security.

What is JWT and Why is it Needed?

JWT consists of three parts separated by dots:

• Header — contains the token type and signing algorithm (e.g., HS256 or RS256).
• Payload — contains claims such as user ID, roles, and expiration time.
• Signature — created based on the header, payload, and secret key.

In Java, JWT is most commonly used for:

• User authentication without storing sessions on the server (stateless).
• Transferring access rights between microservices.
• One-time tokens for password reset or email confirmation.

JJWT Library (io.jsonwebtoken)

JJWT is the most popular library for working with JWT in Java. It is easy to use, supports all standard algorithms (HS256, RS256, ES256), and is actively maintained.

Adding JJWT via Maven

<dependency>    <groupId>io.jsonwebtoken</groupId>    <artifactId>jjwt-api</artifactId>    <version>0.12.6</version></dependency><dependency>    <groupId>io.jsonwebtoken</groupId>    <artifactId>jjwt-impl</artifactId>    <version>0.12.6</version>    <scope>runtime</scope></dependency><dependency>    <groupId>io.jsonwebtoken</groupId>    <artifactId>jjwt-jackson</artifactId>    <version>0.12.6</version>    <scope>runtime</scope></dependency>

Creating a JWT Token

import io.jsonwebtoken.Jwts;import io.jsonwebtoken.SignatureAlgorithm;import io.jsonwebtoken.security.Keys;import javax.crypto.SecretKey;import java.util.Date;

public class JwtExample {    public static void main(String[] args) {        // Generate a secure secret key for HS256        SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256);

        String token = Jwts.builder()            .subject("user123")            .claim("role", "admin")            .issuedAt(new Date())            .expiration(new Date(System.currentTimeMillis() + 3600000)) // 1 hour            .signWith(key)            .compact();

        System.out.println("Created JWT: " + token);    }}

Verifying and Parsing JWT

import io.jsonwebtoken.Claims;import io.jsonwebtoken.Jws;import io.jsonwebtoken.JwtException;import io.jsonwebtoken.Jwts;

public class JwtParserExample {    public static void main(String[] args) {        String jwtToken = "eyJhbGciOiJIUzI1NiJ9..."; // your token        SecretKey key = ...; // the same key used during creation

        try {            Jws<Claims> claimsJws = Jwts.parser()                .verifyWith(key)                .build()                .parseSignedClaims(jwtToken);

            Claims claims = claimsJws.getPayload();            System.out.println("Subject: " + claims.getSubject());            System.out.println("Role: " + claims.get("role"));            System.out.println("Expiration: " + claims.getExpiration());        } catch (JwtException e) {            System.out.println("Token is invalid: " + e.getMessage());        }