Comparison
Free Plugin vs Pro: Basic Auth vs Complete Management
Basic JWT Authentication
Add login via JSON Web Tokens.
Token Generation
Issue access tokens on successful auth.
Token Validation
Verify token integrity on each request.
Token Refresh
Secure refresh with 64-char tokens and replay attack prevention.
Instant Revocation
Revoke compromised sessions immediately.
Token Dashboard
See every active token, owner, expiry, and last activity.
Auto-Revoke on Password Change
All sessions killed when a password is compromised.
Auto-Revoke on Email/Role Change
Sessions invalidated on identity or permission changes.
Analytics Dashboard
Success/failure rates, response times, 7d/30d/90d history.
GeoIP Tracking
Country detection from IP via MaxMind GeoLite2.
Rate Limiting
IP-based, 60 req/min default, configurable, HTTP 429 responses.
Security Headers
Automatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection.
Token Family Tracking
Detects refresh token replay attacks by tracking token lineage.
All Settings via WordPress UI
No wp-config.php editing required.
Configurable Signing Algorithms
HS256, RS256, ES256, EdDSA and more — from the UI.
IP Anonymization
GDPR-compliant option to anonymize stored IP addresses.
Data Retention Policies
Configurable 1–365 day retention for analytics and token data.
Priority Support
Direct help from the developer.
Detailed Documentation
Guides, examples, and best practices.
30+ Developer Hooks & Filters
Actions and filters for deep integration.
| Feature | WP.org version | JWT Auth Pro |
|---|---|---|
| Core Authentication | ||
Basic JWT Authentication Add login via JSON Web Tokens. | Included in WP.org version | Included in JWT Auth Pro |
Token Generation Issue access tokens on successful auth. | Included in WP.org version | Included in JWT Auth Pro |
Token Validation Verify token integrity on each request. | Included in WP.org version | Included in JWT Auth Pro |
| Token Management | ||
Token Refresh Secure refresh with 64-char tokens and replay attack prevention. | Not included in WP.org version | Included in JWT Auth Pro |
Instant Revocation Revoke compromised sessions immediately. | Not included in WP.org version | Included in JWT Auth Pro |
Token Dashboard See every active token, owner, expiry, and last activity. | Not included in WP.org version | Included in JWT Auth Pro |
Auto-Revoke on Password Change All sessions killed when a password is compromised. | Not included in WP.org version | Included in JWT Auth Pro |
Auto-Revoke on Email/Role Change Sessions invalidated on identity or permission changes. | Not included in WP.org version | Included in JWT Auth Pro |
| Visibility & Security | ||
Analytics Dashboard Success/failure rates, response times, 7d/30d/90d history. | Not included in WP.org version | Included in JWT Auth Pro |
GeoIP Tracking Country detection from IP via MaxMind GeoLite2. | Not included in WP.org version | Included in JWT Auth Pro |
Rate Limiting IP-based, 60 req/min default, configurable, HTTP 429 responses. | Not included in WP.org version | Included in JWT Auth Pro |
Security Headers Automatic HSTS, X-Frame-Options, X-Content-Type-Options, XSS-Protection. | Not included in WP.org version | Included in JWT Auth Pro |
Token Family Tracking Detects refresh token replay attacks by tracking token lineage. | Not included in WP.org version | Included in JWT Auth Pro |
| Configuration & Compliance | ||
All Settings via WordPress UI No wp-config.php editing required. | Not included in WP.org version | Included in JWT Auth Pro |
Configurable Signing Algorithms HS256, RS256, ES256, EdDSA and more — from the UI. | Not included in WP.org version | Included in JWT Auth Pro |
IP Anonymization GDPR-compliant option to anonymize stored IP addresses. | Not included in WP.org version | Included in JWT Auth Pro |
Data Retention Policies Configurable 1–365 day retention for analytics and token data. | Not included in WP.org version | Included in JWT Auth Pro |
| Support & Developer Tools | ||
Priority Support Direct help from the developer. | Not included in WP.org version | Included in JWT Auth Pro |
Detailed Documentation Guides, examples, and best practices. | Not included in WP.org version | Included in JWT Auth Pro |
30+ Developer Hooks & Filters Actions and filters for deep integration. | Not included in WP.org version | Included in JWT Auth Pro |
Ready to upgrade from basic auth to complete API management?
Features
Not Just Authentication. Complete Token Control.
Token Dashboard
Every active token in one view — who owns it, when it was issued, when it expires, last activity. Revoke any token with one click.
Token management
Manage authentication tokens for API access and service integrations.
Usage Analytics
Authentication events, success and failure rates, response times, geographic distribution. Choose 7-day, 30-day, or 90-day windows.
Custom Claims
Add custom claims to JWT tokens using WordPress filters
add_filter('jwt_auth_token_before_sign', function($token, $user) {
$token['customer_type'] = get_user_meta($user->ID, 'customer_type', true);
$token['loyalty_points'] = get_user_meta($user->ID, 'loyalty_points', true);
$token['preferred_currency'] = get_user_meta($user->ID, 'currency', true);
$token['customer_id'] = get_user_meta($user->ID, 'customer_id', true);
$token['customer_email'] = get_user_meta($user->ID, 'customer_email', true);
return $token;
}, 10, 2);Automatic Revocation Policies
Tokens auto-revoke on password change, email change, or role change. One compromised account doesn’t mean open API access.
Security Audit Trail
Complete compliance logging with full context
Rate Limiting & Security Headers
IP-based rate limiting at 60 req/min (configurable), automatic HSTS, X-Frame-Options, and XSS protection headers. No nginx config required.
Admin Configuration Interface
All settings are managed through the admin interface.
Complete Features Overview
Explore all the features that make JWT Authentication Pro the most comprehensive authentication solution for WordPress. Each feature is designed with security, performance, and developer experience in mind.
Authentication & Token Management
Professional JWT Token Creation
Industry-standard JWT tokens with configurable expiration (minutes to years)
Multiple Signing Algorithms
Support for HS256, RS256, and all Firebase JWT library algorithms
Token Payload Customization
Add custom user data and claims to JWT token payload
Multi-Layer Token Validation
Signature, expiration, issuer, and revocation checks
Bearer Token Support
Standard Authorization header parsing
Secure Token Hashing
All tokens hashed with WordPress security functions before storage
Secure Refresh Tokens
Cryptographically secure refresh token generation
Independent Expiration Control
Separate expiration settings for JWT and refresh tokens (default 30 days)
Token Rotation
Automatic token rotation with family relationship maintenance
| Authentication & Token Management | |
Professional JWT Token Creation | Industry-standard JWT tokens with configurable expiration (minutes to years) |
Multiple Signing Algorithms | Support for HS256, RS256, and all Firebase JWT library algorithms |
Token Payload Customization | Add custom user data and claims to JWT token payload |
Multi-Layer Token Validation | Signature, expiration, issuer, and revocation checks |
Bearer Token Support | Standard Authorization header parsing |
Secure Token Hashing | All tokens hashed with WordPress security functions before storage |
Secure Refresh Tokens | Cryptographically secure refresh token generation |
Independent Expiration Control | Separate expiration settings for JWT and refresh tokens (default 30 days) |
Token Rotation | Automatic token rotation with family relationship maintenance |
What everyone is saying
60,000+ Sites Trust Our Authentication
Implementation
Add JWT Authentication in Minutes. Manage It Forever.
Generate Token
Authenticate users and issue JWT tokens with a single API call. Receive both user details and tokens in one seamless response.
Validate Token
Ensure robust security with built-in JWT validation. Verify token signatures and claims to confirm authenticity and expiration status.
Refresh Token
Keep users seamlessly authenticated while maintaining strong security. Automatically manage token expiration and renewal.
Pricing
Simple, Site-Based Pricing
Professional Single Site
Ideal for individual WordPress sites requiring robust, professional-grade API authentication solutions.
USD
per year
Features:
- 1 site
- Token Management Dashboard
- Token Refresh with Replay Detection
- Instant & Auto Revocation
- Usage Analytics (7d/30d/90d)
- Rate Limiting & Security Headers
- GeoIP Tracking
- All Settings via UI — No wp-config.php
- IP Anonymization & Data Retention
- 30+ Developer Hooks & Filters
- Priority Support
Professional Team (5 Sites)
Secure and manage multiple WordPress sites with ease—perfect for teams and small businesses.
USD
per year
Features:
- Up to 5 sites
- Token Management Dashboard
- Token Refresh with Replay Detection
- Instant & Auto Revocation
- Usage Analytics (7d/30d/90d)
- Rate Limiting & Security Headers
- GeoIP Tracking
- All Settings via UI — No wp-config.php
- IP Anonymization & Data Retention
- 30+ Developer Hooks & Filters
- Priority Support
Professional Agency (20 Sites)
Comprehensive API security tailored for agencies and developers managing multiple client sites.
USD
per year
Features:
- Up to 20 sites
- Token Management Dashboard
- Token Refresh with Replay Detection
- Instant & Auto Revocation
- Usage Analytics (7d/30d/90d)
- Rate Limiting & Security Headers
- GeoIP Tracking
- All Settings via UI — No wp-config.php
- IP Anonymization & Data Retention
- 30+ Developer Hooks & Filters
- Priority Support
- White-labeling
Note: JWT Authentication Pro requires PHP 8.1 or higher
Common Questions
Get the answers you need
- Does this plugin work out of the box?
When you install JWT Authentication Pro, a professional JWT authentication layer is added on top of the WordPress REST API. This enables you to create, validate, and revoke JWT tokens for your WordPress users, allowing them to authenticate and make API requests from external systems, mobile apps, or web applications. However, you will need to implement the authentication logic in those external systems or applications. This plugin provides the JWT authentication infrastructure and advanced token management - the client-side implementation is up to you.
- Is JWT Authentication Pro a Single Sign-On (SSO) system?
No, JWT Authentication Pro is not an SSO solution. It does not integrate with external identity providers like Google, Microsoft, or SAML systems. It is specifically designed to add token-based authentication to the WordPress REST API for external applications, not for cross-platform single sign-on.
- Does this plugin replace WordPress user management or login system?
No, JWT Authentication Pro does not replace WordPress's built-in user authentication system. It does not handle user registration, password resets, or traditional WordPress login pages. It adds token-based authentication specifically for API access while keeping all existing WordPress functionality intact.
- Can I use this for regular WordPress website sessions?
No, JWT Authentication Pro is not designed for managing regular WordPress website sessions or cookie-based authentication. It is specifically built for stateless, token-based API authentication used by external applications like mobile apps, SPAs, or headless WordPress setups.
- Is this a general website security plugin?
No, JWT Authentication Pro is not a general security plugin like Wordfence or Sucuri. It does not protect against malware, secure login pages, or provide general website security features. Its security features are specifically designed for protecting API endpoints and managing token-based authentication.
- What are the system requirements for JWT Authentication Pro?
JWT Authentication Pro requires PHP 8.1 or higher and WordPress 5.0 or higher with REST API enabled. All configuration is managed through the WordPress admin UI — no wp-config.php editing required. (The free plugin requires adding a secret key to wp-config.php, but Pro handles this automatically.) Your server needs HTTP Authorization Header enabled.
- How does token refresh mechanism work?
When you authenticate, you receive both an access token and a refresh token. The access token is used for API requests and expires after a configurable period (default 7 days). When it expires, you can use the refresh token (valid for 30 days by default) to obtain a new access token without re-authenticating with username and password.
- Can I track and analyze JWT usage?
Yes, JWT Authentication Pro includes a detailed analytics dashboard that tracks authentication attempts, token usage, active users, etc. You can configure retention periods as well.
- What happens to tokens when a user changes their password?
By default, all tokens are automatically revoked when a user changes their password, email, or role. This behavior can be customized using filters. The Pro version gives you granular control over token lifecycle management.
- What signing algorithms are supported?
The plugin supports multiple signing algorithms including HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, and PS512. You can choose and configure your preferred algorithm through settings or using the jwt_auth_algorithm filter.
- How can I customize token claims and validation rules?
You can use filters like jwt_auth_token_before_sign and jwt_auth_token_before_dispatch to modify token claims and data. The Pro version also provides an interface for configuring custom validation rules, token lifetime, and security policies.
- How do I handle CORS in my application?
CORS support can be enabled in the plugin settings. The plugin provides filters to customize CORS headers.
- Do you offer refunds?
Yes, we offer a 14-day compatibility guarantee. Refunds are provided only for unresolvable technical compatibility issues that our support team cannot solve. You must work with our support team first before requesting a refund. Payment processor fees (3-5%) are deducted from approved refunds.
- Do you offer a free trial?
No, we do not offer a free trial. However, we provide a 14-day compatibility guarantee for technical incompatibility issues that our support team cannot resolve.
- Do you offer lifetime access?
Yes, we offer lifetime access to JWT Authentication Pro. You can purchase the plugin once and use it as long as you want.
- Does an installation on a local environment count as a site for my license?
No, a site on a local environment does not count as a site for your license. You can use JWT Authentication Pro on your local environment without any restrictions. However, if you deploy your site to a production server, you will need to activate the license key.
- Who is behind JWT Authentication Pro?
JWT Authentication Pro is developed by Enrique Chavez (@tmeister), a seasoned full-stack developer with a strong focus on WordPress and open-source technologies. Enrique has contributed to the WordPress ecosystem for years, creating plugins, and tools that help developers build more efficiently. His commitment to open-source development ensures that his projects, including JWT Authentication Pro, are designed to be simple, flexible, and developer-friendly.