Backend

JWT Authentication in Spring Boot: Complete Guide

Spring Boot is the leading Java framework for enterprise applications. JWT authentication in Spring Boot is typically implemented with Spring Security filters and the jjwt library. This guide walks you through everything you need to implement robust JWT authentication in Spring Boot, from choosing the right library to writing production-ready code.

Recommended JWT Library for Spring Boot

jjwt (io.jsonwebtoken)

The recommended library for handling JWT authentication in Spring Boot. It provides a mature API, active maintenance, and wide community adoption — making it the go-to choice for production applications built with Spring Boot.

Whether you are building a small prototype or a large-scale enterprise application, jjwt (io.jsonwebtoken) gives you the tools to generate, sign, verify, and decode JWT tokens with confidence. It supports all major signing algorithms including HS256, RS256, and ES256, and integrates naturally with the Spring Boot ecosystem.

JWT Authentication Code Example

Below is a practical code example showing how to implement JWT authentication in Spring Boot using jjwt (io.jsonwebtoken). This snippet demonstrates the core pattern you will use in most applications:

Spring Boot — JWT Examplejjwt (io.jsonwebtoken)

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;

@Component
public class JwtUtil {
    private final SecretKey key = Keys.hmacShaKeyFor(secret.getBytes());

    public String generateToken(String username) {
        return Jwts.builder()
            .setSubject(username)
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + 86400000))
            .signWith(key)
            .compact();
    }

    public Claims extractClaims(String token) {
        return Jwts.parserBuilder()
            .setSigningKey(key).build()
            .parseClaimsJws(token).getBody();
    }
}

This example shows the essential JWT workflow in Spring Boot. In production, make sure to store secrets in environment variables, use HTTPS, and implement proper error handling for token expiration and revocation.

How to Set Up JWT in Spring Boot

Follow these steps to get JWT authentication working in your Spring Boot project. Each step builds on the previous one, so we recommend following them in order:

1
Add jjwt dependency to pom.xml or build.gradle
2
Create JwtUtil class for token generation and validation
3
Build JwtAuthenticationFilter extending OncePerRequestFilter
4
Configure SecurityFilterChain to use the JWT filter
5
Set session management to STATELESS

Key Features of JWT Auth in Spring Boot

When you implement JWT authentication in Spring Boot, you gain access to several powerful capabilities that make your application more secure and scalable:

Spring Security filter chain

JwtAuthenticationFilter

Role-based authorization

Stateless session management

Why Use JWT Authentication in Spring Boot?

Spring Boot is widely used for building modern web applications and APIs, and JWT has become the de facto standard for stateless authentication. By combining Spring Boot with JWT, you get a scalable authentication system that does not require server-side session storage.

JWT tokens are self-contained, meaning they carry all the information needed to identify a user and their permissions. This makes them ideal for microservice architectures, mobile backends, and single-page applications built with Spring Boot. Each request includes the token, so your server can verify identity without a database lookup.

The jjwt (io.jsonwebtoken) library makes it straightforward to implement JWT in Spring Boot. You can generate tokens on login, verify them on each request, and handle token refresh to keep users authenticated without interruption. Combined with proper security practices — such as short expiration times, refresh token rotation, and secure storage — JWT provides a robust foundation for any authentication system.

Best Practices for JWT in Spring Boot

When implementing JWT authentication in Spring Boot, follow these best practices to keep your application secure:

Use strong secrets: Always use a long, random secret key for signing tokens. Store it in environment variables, never in source code.
Set short expiration times: Access tokens should expire quickly (15–30 minutes). Use refresh tokens for longer sessions.
Validate on every request: Always verify the token signature and check expiration before granting access to protected resources.
Use HTTPS: JWT tokens sent over plain HTTP can be intercepted. Always use HTTPS in production to protect tokens in transit.
Handle token refresh: Implement a refresh token flow so users are not logged out when their access token expires. Rotate refresh tokens to prevent replay attacks.
Do not store sensitive data in tokens: JWT payloads are Base64-encoded, not encrypted. Avoid putting passwords or other sensitive information in claims.

Decode & Inspect JWT Tokens Instantly

Use our free online JWT Decoder to inspect any token — view the header, payload, claims, and expiration status right in your browser. No sign-up required.

Try JWT Decoder Pro →