> JWTs are vulnerable to brute force attacks once intercepted.<p>On the linked PDF it says:<p>> Shorter keys can be brute forced.<p>Yeah... don't use short keys.<p>And then also misquotes:<p>> JWT token cannot be invalidated <i>by itself</i><p>JWT _can_ be invalidated, you just need to somehow store the invalidated tokens, depending on the use case this can make sense, since the number of invalidated tokens is going to be way smaller.<p>> But if we need to send this on every request, we need to persist these credentials somewhere. In a native mobile environments, there are secure options, but on browsers we only have localStorage or sessionStorage, both of which are 100% insecure.<p>The mobile version is not secure either... You need access to the raw payload, so if the app has a remote code execution vulnerability, the attacker is going to be able to read the token.