0

My goal is to encrypt end-to-end messaging app messages. I am wondering if it's possible to encrypt/decrypt messages using token authentication libraries such as jsonwebtoken? Is it a good approach or there are is dedicated library/algorithm for that?

Thank you mates in advance!

spatak
  • 1,039
  • 1
  • 14
  • 25

1 Answers1

1

No mate, JWT can't be used to encrypting/decryting messages. Because the data in the Jsonwebtoken can be read by any third party.

Real purpose of JWT in early days for using message can be something like ensuring message integrity. Means ​message is not tampered while sending and receiving.

If you want implement real end-to-end encryption(not even server read the message). You should implement like whatsapp. WhatsApp is using diffie Hellman Algorithm which is more secure way for end to end encryption. But it takes lot of work and implementation.

For simple implementation use symmetric encryption and decryption. Check this link below.

https://hackernoon.com/creating-real-time-chat-app-using-react-and-socketio-with-e2e-encryption-b0113u5s

Aghilan B
  • 493
  • 7
  • 18
  • Thanks mate for the response. But do you want to say that JWT is not secure? – spatak Nov 30 '21 at 11:06
  • Purpose of encrypting a data is for hiding from third party, right. But when we encoded a data with JWT, it's actually BASE64 encoded not encrypted. So the payload in jwt is viewable by anyone. Please check this https://jwt.io/ and paste your any enocded JWT data. It is readable by anyone even after if encoded. – Aghilan B Nov 30 '21 at 11:18