Authentication Strategy Chooser
Answer six questions and compare sessions, JWT, OAuth/OIDC, passkeys and magic links with their tradeoffs.
auth-chooserLOCAL WORKSPACE
1. Configure and explore
Inputs stay in this tab; no browser persistence, page-URL encoding or network requests.
2. Results and interpretation
Choose a sample, fill the fields or explore the flow.
| Option | Tradeoffs and limits |
|---|---|
| Server session | Opaque HttpOnly cookie; central revocation and CSRF defenses; needs server state. |
| JWT | Signed claims are readable, not encrypted; short expiry, issuer/audience/algorithm checks and refresh/revocation design. |
| OAuth + OIDC | OAuth delegates access; OIDC provides identity. Validate state, PKCE and ID-token issuer/audience/nonce. |
| Passkey | Origin-bound public-key sign-in; plan account recovery and server challenge/assertion verification. |
| Magic link | Single-use expiring email link; depends on mailbox security, delivery and link-scanner handling. |
A heuristic cannot replace threat modeling. Login methods and session mechanisms are different layers and often work together.
Data / rules date: 2026-10-21 · Official source
How to use this tool
Answer every question, review the explicit decision rules, compare all methods and export your planning notes.
When not to use it
A heuristic cannot replace threat modeling. Login methods and session mechanisms are different layers and often work together.
Read the guide →