BackendReel #30 · 4 Nov 2026

Login dabane ke baad kya hota hai? JWT ki group chat

Login flow: client credentials bhejta hai, server password hash compare karta hai, aur match par ek signed JWT (JSON Web Token, RFC 7519) deta hai. JWT ke teen base64url hisse hote hain: header, payload (claims, jaise exp) aur signature. Server har request par signature verify karta hai, isliye usse session yaad nahi rakhna padta. Payload sirf encoded hai, encrypted nahi. Access token chhote time ke liye hota hai; naya token refresh token (OAuth 2.0, RFC 6749) se milta hai.

Links

RFC 7519: JSON Web Token JWT ka official standard

jwt.io: Introduction to JWT header, payload, signature

RFC 6749: OAuth 2.0 (refresh tokens) section 1.5: refresh token

Aaj ye karo

Browser console mein apne token ka payload dekho: JSON.parse(atob(token.split('.')[1]))
exp claim dekho: ye Unix time hai jab token expire hoga.
Payload mein password, card ya koi secret kabhi mat daalo.
Access token chhota rakho (minutes), lambe session ke liye refresh token use karo.

JSON.parse(atob(token.split('.')[1]))

Sources

IETF RFC 7519 aur 6749, jwt.io; 4 Nov 2026 ko check kiya.