What is a JWT? JSON Web Tokens explained simply
JSON Web Tokens (JWTs) power authentication in a huge share of modern apps. They look like an intimidating blob of random characters, but the structure is simple once you see the three parts.
The three parts
A JWT is three Base64-URL encoded sections separated by dots: header.payload.signature.
- Header — says what type of token it is and which algorithm signed it.
- Payload — the actual data ("claims"): who the user is, when the token expires, what they're allowed to do.
- Signature — a cryptographic seal that proves the token wasn't altered and was issued by someone with the secret key.
How it's used
When you log in, the server creates a JWT describing you and signs it, then hands it to your browser. On every subsequent request, your browser sends the token back, and the server verifies the signature instead of looking you up in a database each time. That statelessness is why JWTs scale well.
The most important security fact
A JWT is signed, not encrypted. The payload is only Base64 — anyone can read it.
This trips people up constantly. You can decode any JWT and see its contents in plain text. So never put secrets — passwords, private data — in the payload. The signature stops tampering; it does not hide the contents.
Common gotchas
- Expiration: check the
expclaim — an expired token should be rejected. - Don't trust an unverified token: always validate the signature server-side before believing the claims.
- Decoding ≠ verifying: reading a token is easy; confirming it's genuine requires the key.
The fastest way to understand one is to paste it into a decoder and inspect the header and payload for yourself.