JSON Web Tokens (JWTs) have become the de facto standard for API authentication and authorization. From OAuth2 flows to microservice communication, JWTs are everywhere. They are lightweight, self-contained, and easy to use.
However, JWT security relies heavily on cryptographic algorithms such as RSA and Elliptic Curve Digital Signature Algorithm (ECDSA). These algorithms are strong today, but they will be broken by quantum computers running Shor’s algorithm in the future.
That means JWTs signed with RSA or ECDSA could be forged in a post-quantum world. Attackers might not be able to do it today, but they can capture tokens and replay them once quantum computing advances. Developers must start preparing for post-quantum cryptography (PQC) to protect APIs and applications.
How JWT Works Today
A JWT typically has three parts:
- Header – defines the algorithm and token type.
{ "alg": "RS256", "typ": "JWT" } - Payload – contains claims such as issuer, subject, expiration.
{ "sub": "user123", "exp": 1710001200, "scope": "read:orders" } - Signature – ensures integrity and authenticity.
HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
The problem is that RSA and ECDSA (common signature algorithms) will not stand against future quantum computers.
Risks in the Post-Quantum Era
- Signature Forgery: Quantum computers could derive private keys from public keys, allowing attackers to sign their own JWTs.
- Replay Attacks: Captured tokens could be used even if expired, by re-signing with forged keys.
- Long-Term Data Exposure: Tokens used today might be stored by attackers and broken years later.
Post-Quantum Alternatives for JWT
PQC Signature Algorithms
NIST’s chosen algorithms for signatures in 2024:
- CRYSTALS-Dilithium – lattice-based, efficient and secure.
- Falcon – compact signatures, suitable for constrained environments.
- SPHINCS+ – hash-based, extremely secure but with larger signatures.
Instead of:
{ "alg": "RS256", "typ": "JWT" }
Future JWTs may look like:
{ "alg": "Dilithium3", "typ": "JWT" }
Hybrid Approaches
Since PQC algorithms are still being standardized and adoption takes time, many systems will run in hybrid mode:
- Current Algorithm + PQC Algorithm
- Both signatures must validate successfully for the token to be accepted.
Example header for hybrid JWT:
{ "alg": "RS256+Dilithium3", "typ": "JWT" }
Best Practices for Developers
- Short Token Lifetimes: Use tokens that expire quickly to limit exposure.
- Token Binding: Link tokens to TLS sessions so they cannot be replayed elsewhere.
- Hybrid Algorithms: Start testing JWT libraries with PQC support.
- Secure Storage: Avoid putting tokens in localStorage. Use HttpOnly cookies or secure token vaults.
- Monitoring: Track unusual JWT usage, like expired tokens being reused.
Example: PQC-Enabled JWT Signing (Python with pyca/oqs)
from oqs import Signature
# Generate PQC key pair
sig = Signature("Dilithium3")
public_key = sig.generate_keypair()
message = b"JWT header + payload"
signature = sig.sign(message)
# Verification
is_valid = sig.verify(message, signature, public_key)
print("Signature valid:", is_valid)
This can be integrated into JWT libraries as PQC support matures.
Migration Roadmap
- Audit JWT usage – Identify where JWTs are used in your system.
- Test PQC libraries – Experiment with Dilithium or Falcon signatures.
- Adopt hybrid JWTs – Use classical + PQC signing together.
- Plan gradual rollout – Start with internal APIs before customer-facing ones.
- Stay updated with IETF JOSE standards – Post-quantum JWT drafts are emerging.
Frequently Asked Questions
Will JWTs become obsolete in the post-quantum world?
No. JWTs remain useful, but the cryptography behind them must evolve. PQC will secure them against future attacks.
Which PQC algorithm is best for JWT?
Dilithium is expected to be the primary replacement due to its efficiency, but Falcon may be better for small tokens.
Should I migrate my APIs now?
You should start testing hybrid approaches now, but full production migration will depend on library and ecosystem maturity.
Will PQC make JWTs larger?
Yes. PQC signatures are larger, which means tokens will increase in size. Developers must account for storage and network implications.
For interview preparation, Be ready to explain:
- Why RSA/ECDSA are at risk in quantum era.
- How PQC algorithms like Dilithium work for JWT signing.
- Strategies like short-lived tokens and hybrid signing.
Conclusion
JWTs power the authentication and authorization of most APIs and modern apps. But with the rise of quantum computing, their current security foundations will not last. Developers must start future-proofing JWTs using post-quantum algorithms like Dilithium and Falcon, along with hybrid approaches.
By combining short token lifetimes, secure storage, and PQC readiness, you can ensure that your APIs remain secure both today and in the quantum future.
The sooner you start experimenting with PQC JWTs, the smoother the migration will be when standards become mainstream.
