> Markdown version of [/events/world-congress-2026-europe/sessions/1287-how-to-mess-up-jwt-s](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1287-how-to-mess-up-jwt-s). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# How to mess up JWT's - a practitioner's guide


- **Date:** Friday, Jul 10, 2026
- **Time:** 12:15–14:15 (120 min)
- **Room:** Room M3 (18 Seats)
- **Event:** World Congress 2026 Europe

## Description

JSON Web Tokens are everywhere - you are using a bunch of them right now. It's such a common technology, yet, it's very easy to get them wrong. In this session, we get to the nitty gritty of JWT's - what they are, how they work, and how to make sure that we haven't made an app that just waits to be hacked.

## Speaker

### [Wekoslav Stefanovski](https://www.wearedevelopers.com/@wekoslav-stefanovski)

Head Of Development at Sourcico


## Related talks at this congress

- [Rest API Antipatterns](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1224-rest-api) — Wekoslav Stefanovski
- [Trust Issues: Because Zero-Trust Isn’t Optional Anymore](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1097-trust-issues-because) — Jan Peer Stöcklmair
- [An Opinionated Guide to Bulletproof APIs](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1209-an-opinionated-guide) — Rustam Mehmandarov
- [When Value Becomes Programmable: A Developer's Guide to Tokenization](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1310-when-value-becomes) — Luke Forrest