Session Management

JWTs let a session be verified without a database lookup on every request, but that speed only stays safe if expiration, signing, and revocation are handled correctly.

A JWT has three parts — header, payload, signature — and only the signature prevents tampering

Short expiration windows (e.g. 20 minutes) limit how long a stolen token stays useful

Logout should invalidate the session server-side, not just delete the client-side copy

Users can hold multiple valid sessions across devices, each independently revocable

Hands-on demo

JWT Session Token

Active Sessions

Each device holds its own independently-revocable session.

MacBook Pro · Chrome

This device · active now

iPhone 15 · Safari

2 minutes ago

iPad Air · Safari

3 days ago

Try it yourself

Try it yourself — run a scenario below, then flip this and replay it to see what changes.

JWT Creation

Watch a session token get assembled piece by piece.

Want this flow explained in detail as it plays?

app.flowground.dev

Session token

algHS256

subuser_8841

App

Browser

{"alg":"HS256","typ":"JWT"} — declares the signing algorithm.

Selected hop

Header encoded

App

The application's backend — enforces business rules and decides what every request is allowed to do.

App

The application's backend — enforces business rules and decides what every request is allowed to do.

What happens here

{"alg":"HS256","typ":"JWT"} — declares the signing algorithm.