That's probably best addressed by the “security considerations” section of the JWT spec: https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-25#section

That's probably best addressed by the “security considerations” section of the JWT spec: https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-25#section-11 https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-... My short answer to “How secure are JSON Web Tokens?”, though, would be that the relevant security issues are likely to come in “around” the use of JWTs, not as a result of JWTs themselves being “weak”. JWT is just a set of conventions for encoding authn/authz claims in JSON and then encrypting/signing the result.