Ilya
What best way to use JWT authentication in phoenix?
pow, guardian or maybe some thing else?
Thanks 
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
We build reliable cloud platforms for business-critical systems.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ai
- #ecto-query
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #metaprogramming
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 6 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
hauleth
It is not hatred, it is more of a pity. JWT is abused in places where it shouldn’t be used as stateless tokens aren’t suitable for general purpose authentication. Also JWT just done poor choices from the security viewpoint. It is much better to use versioned and fixed set of small, proven, and chosen by experts, algorithms than to allow everyone to pick their own, as in the end it can cause leakages. PASETO for stateless tokens (when needed) is much better. However for general purpose authentication over HTTP it is much better to use sessions with good old signed cookies (especially if marked as
http-onlycookies).In general - when used properly, JWT isn’t that bad, but there are better options for such uses anyway.
No idea. I do not use Guardian at all.
darnahsan
can paseto be used with guardian ?
chungwong
The hatred of JWT almost jumped out from my monitor, vividly.
thojanssens1
Have also a look at
phx_gen_authwhich will eventually be part of Phoenix:https://github.com/aaronrenner/phx_gen_auth
It’s not JWT specifically but it uses token.
hauleth
If it is user facing auth then I would say - don’t. Just use regular session cookies, and if you want signed tokens, then PASETO is better choice.
andreaseriksson
I would say Guardian. But I have not made an extensive comparison.
Aslo, you can use Guardian with Pow or other libraries.