JWT token generation and verification in Node.js - Step-by-Step Execution

Concept Flow - JWT token generation and verification

Start

↓

Create Payload

↓

Sign Payload with Secret

↓

Generate JWT Token

↓

Send Token to Client

↓

Client Sends Token Back

↓

Verify Token with Secret

↓

If Valid -> Access Granted

↓

If Invalid -> Access Denied

This flow shows how a JWT token is created by signing data, sent to a client, then verified later to allow or deny access.

Execution Sample

Node.js

import jwt from 'jsonwebtoken';

const secret = 'mysecret';
const payload = { userId: 123 };

const token = jwt.sign(payload, secret);

const verified = jwt.verify(token, secret);

This code creates a JWT token from a payload and secret, then verifies the token using the same secret.

Execution Table

Step	Action	Input	Output	Notes
1	Define secret	'mysecret'	'mysecret'	Secret key for signing and verifying
2	Create payload	{ userId: 123 }	{ userId: 123 }	Data to encode in token
3	Sign payload	payload + secret	JWT token string	Token is a long string with header.payload.signature
4	Send token	JWT token string	Token sent to client	Client stores token
5	Receive token	Token from client	JWT token string	Token sent back for verification
6	Verify token	Token + secret	{ userId: 123 }	Returns decoded payload if valid
7	Access decision	Verification result	Access granted	If token valid, allow access
8	End	-	-	Process complete

💡 Verification fails if token is tampered or secret is wrong, then access is denied.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 6	Final
secret	undefined	'mysecret'	'mysecret'	'mysecret'	'mysecret'
payload	undefined	{ userId: 123 }	{ userId: 123 }	{ userId: 123 }	{ userId: 123 }
token	undefined	undefined	JWT token string	JWT token string	JWT token string
verified	undefined	undefined	undefined	{ userId: 123 }	{ userId: 123 }

Key Moments - 3 Insights

Why do we need the same secret for signing and verifying the JWT token?

Because the secret is used to create the signature part of the token. If the secret is different during verification, the signature won't match and verification fails. See execution_table step 6.

What happens if the token is changed after it is created?

If the token is tampered, the signature won't match the payload and header, so verification fails and access is denied. This is why the token is secure. See execution_table exit_note.

Is the payload data encrypted in the JWT token?

No, the payload is only encoded (base64), not encrypted. Anyone with the token can read it, but cannot change it without the secret. See execution_table step 3.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'verified' after step 6?

A { userId: 123 }

B JWT token string

C undefined

D Access granted

💡 Hint

Check the 'verified' variable value in variable_tracker after step 6.

At which step is the JWT token string created?

A Step 2

B Step 3

C Step 5

D Step 6

💡 Hint

Look at the 'Action' and 'Output' columns in execution_table for token creation.

If the secret used in step 6 is different from step 3, what happens?

A Verification succeeds

B Token is regenerated

C Verification fails

D Payload changes

💡 Hint

Refer to key_moments about secret matching and verification.

Concept Snapshot

JWT token generation and verification:
- Use jwt.sign(payload, secret) to create token
- Token includes header, payload, and signature
- Send token to client for authentication
- Use jwt.verify(token, secret) to check token validity
- Same secret must be used for signing and verifying
- Payload is encoded, not encrypted

Full Transcript

This visual execution shows how JWT tokens are generated and verified in Node.js. First, a secret key is defined. Then, a payload object with user data is created. The payload is signed with the secret using jwt.sign, producing a JWT token string. This token is sent to the client, who stores it. Later, the client sends the token back to the server. The server verifies the token using jwt.verify with the same secret. If verification succeeds, the decoded payload is returned and access is granted. If verification fails, access is denied. The secret must be the same for signing and verifying to ensure security. The payload is only encoded, so it can be read but not changed without invalidating the token.

Practice

1. What is the main purpose of a JWT token in a Node.js application?

easy

A. To securely transmit user identity without sending passwords repeatedly

B. To store user passwords in the database

C. To encrypt all user data on the server

D. To create a permanent session without expiration

Solution

1. Step 1: Understand JWT token purpose

   JWT tokens are used to prove user identity securely without sending passwords every time.

2. Step 2: Compare options

   Only To securely transmit user identity without sending passwords repeatedly correctly describes this purpose; others describe unrelated or incorrect uses.

3. Final Answer:

   To securely transmit user identity without sending passwords repeatedly -> Option A

4. Quick Check:

   JWT purpose = Secure identity proof [OK]

Hint: JWT = identity proof without password resend [OK]

Common Mistakes:

• Thinking JWT stores passwords
• Confusing JWT with encryption of all data
• Assuming JWT creates permanent sessions

2. Which of the following is the correct syntax to generate a JWT token using the jsonwebtoken library in Node.js?

easy

A. jwt.generate(payload, secretKey, { expiresAt: '1h' })

B. jwt.create(payload, secretKey, { expiresIn: '1h' })

C. jwt.sign(payload, secretKey, { expiresIn: '1h' })

D. jwt.make(payload, secretKey, { expire: '1h' })

Solution

1. Step 1: Recall jsonwebtoken method for token creation

   The correct method to create a token is jwt.sign with payload, secret, and options.

2. Step 2: Check option syntax

   Only jwt.sign(payload, secretKey, { expiresIn: '1h' }) uses jwt.sign and correct option key expiresIn; others use invalid method names or option keys.

3. Final Answer:

   jwt.sign(payload, secretKey, { expiresIn: '1h' }) -> Option C

4. Quick Check:

   Token creation method = jwt.sign [OK]

Hint: Use jwt.sign() with expiresIn option for token creation [OK]

Common Mistakes:

• Using wrong method names like create or generate
• Using expiresAt or expire instead of expiresIn
• Missing the secret key argument

3. Given the code snippet:

const jwt = require('jsonwebtoken');
const token = jwt.sign({ userId: 123 }, 'secret123', { expiresIn: '2h' });
const decoded = jwt.verify(token, 'secret123');
console.log(decoded.userId);

What will be the output when this code runs?

medium

A. 123

B. undefined

C. Error: invalid token

D. null

Solution

1. Step 1: Understand token creation and verification

   The token is created with payload { userId: 123 } and secret 'secret123', then verified with the same secret.

2. Step 2: Check decoded payload output

   jwt.verify returns the original payload if token is valid, so decoded.userId is 123.

3. Final Answer:

   123 -> Option A

4. Quick Check:

   Decoded userId = 123 [OK]

Hint: Verify with same secret returns original payload [OK]

Common Mistakes:

• Expecting undefined or null instead of payload
• Using different secret causing invalid token error
• Not understanding jwt.verify returns payload

4. Identify the error in this JWT verification code snippet:

const jwt = require('jsonwebtoken');
const token = jwt.sign({ id: 1 }, 'mysecret');
const decoded = jwt.verify(token, 'wrongsecret');
console.log(decoded.id);

medium

A. Token is expired

B. jwt.sign method is used incorrectly

C. Payload is missing id property

D. Secret key used for verification is incorrect

Solution

1. Step 1: Check token creation and verification secrets

   Token is signed with 'mysecret' but verified with 'wrongsecret', causing verification failure.

2. Step 2: Understand jwt.verify behavior on secret mismatch

   jwt.verify throws an error if secret does not match, so decoded.id is not accessible.

3. Final Answer:

   Secret key used for verification is incorrect -> Option D

4. Quick Check:

   Secret mismatch = verification error [OK]

Hint: Verify with same secret as sign to avoid errors [OK]

Common Mistakes:

• Assuming token expired without expiration set
• Thinking payload lacks id property
• Misusing jwt.sign method syntax

5. You want to generate a JWT token that expires in 30 minutes and includes the user's email and role. Which code snippet correctly does this using the jsonwebtoken library?

hard

A. jwt.sign({ email: user.email, role: user.role }, 'secretKey', { expire: 1800 })

B. jwt.sign({ email: user.email, role: user.role }, 'secretKey', { expiresIn: '30m' })

C. jwt.sign({ email: user.email, role: user.role }, 'secretKey', { expiresAt: '30min' })

D. jwt.sign({ email: user.email, role: user.role }, 'secretKey', { timeout: '30m' })

Solution

1. Step 1: Identify correct payload and expiration option

   The payload includes email and role, and expiration uses expiresIn with '30m' for 30 minutes.

2. Step 2: Validate option keys and values

   Only jwt.sign({ email: user.email, role: user.role }, 'secretKey', { expiresIn: '30m' }) uses correct option key expiresIn and valid time format '30m'; others use invalid keys or formats.

3. Final Answer:

   jwt.sign({ email: user.email, role: user.role }, 'secretKey', { expiresIn: '30m' }) -> Option B

4. Quick Check:

   expiresIn '30m' = 30 minutes expiry [OK]

Hint: Use expiresIn: '30m' for 30-minute token expiry [OK]

Common Mistakes:

• Using expire or expiresAt instead of expiresIn
• Wrong time format like '30min'
• Using timeout option which is invalid