12-Point JWT Security Checklist Every Developer Should Follow Before Shipping

A practical JWT security checklist highlights that correct signature verification alone is insufficient for secure authentication in production deployments. Key recommendations include using cryptographically secure pseudorandom secrets of at least 256 bits, explicitly specifying allowed algorithms, and setting short token expiry windows of around 15 minutes. Developers are advised to store JWTs in httpOnly cookies rather than localStorage, transmit them only via HTTPS Authorization headers, and implement server-side refresh token logic to enable session revocation. The checklist also warns against leaking sensitive data in JWT payloads, since the payload is base64-encoded and not encrypted, making it readable by anyone. Additional measures include checking for secret exposure in git history, using generic error messages to avoid revealing token details, and storing revoked token IDs in Redis for high-security endpoints.