JWT Explained: How JSON Web Tokens Work for Modern Authentication
A deep dive into JSON Web Tokens (JWT), token anatomy (header, payload, signature), claims, expiration handling, and stateless security.
What is a JSON Web Token?
A JSON Web Token (JWT) is an open industry standard (RFC 7519) for securely transmitting information between parties as a compact, self-contained JSON object. JWTs are commonly used for stateless authorization in web applications, REST APIs, and microservice architectures.
Because the token contains all necessary user claims and permissions, servers can authenticate requests without needing to query a centralized session database on every HTTP request.
Anatomy of a JWT
Every JWT consists of three distinct parts separated by dots (`.`):
1. Header: Specifies the token type (`JWT`) and signing algorithm (`HS256`, `RS256`).
2. Payload: Contains the claims (e.g., user ID `sub`, issued timestamp `iat`, expiration timestamp `exp`, and custom application permissions).
3. Signature: Cryptographic proof generated by hashing the encoded header and payload with a secret key.
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NSIsImV4cCI6MTc3MDAwMDAwMH0.signature_hash_hereSecurity Considerations: Decoding vs. Verifying
It is critical to remember that JWT payloads are only Base64URL-encoded, not encrypted. Anyone who intercepts a JWT can inspect the claims inside. Never store unencrypted passwords, API secret keys, or private financial records inside a JWT payload.
While anyone can decode a JWT payload, only the server holding the secret or private key can create a valid signature.
Interactive Tools for this Guide
Try the client-side utilities directly in Tool Vault: