A JSON Web Token (JWT) is a compact, signed token that carries identity and claims between an app and a server. After a user signs in, the server issues a JWT that the app sends with later requests to prove who it is.
On mobile, the things that matter are where the token is stored and how it is checked. A JWT kept in plain storage can be stolen, and a server that does not verify the signature properly can be tricked. Tokens belong in the keystore or keychain, and the server must always validate them.
Mobexa tests the exact Android or iOS build you ship and maps every finding to the OWASP Mobile Top 10 and MASVS.
Start Free Trial