A signed container of claims
The issuer places claims in the payload and signs the encoded header and payload. The receiver verifies the signature with a trusted key.
JSON WEB TOKEN GUIDE
What is a JWT?
A visual, practical guide to JWT structure, claims, signatures, expiry, access tokens, refresh tokens, validation, logout, and secure API authentication.
JSON Web Token
HEADERalgorithm + type
.PAYLOADclaims + expiry
.SIGNATUREintegrity check
Signed, compact, URL-safeJWT is a token format, not an authentication system by itself
A JWT is a compact string that can carry claims and be cryptographically signed. Authentication protocols decide how it is issued, transported, refreshed, and revoked.
Secret just because it looks scrambled
The header and payload are normally Base64URL encoded, not encrypted. Anyone holding the token can often read them.
Authorization decisions
A valid signature does not automatically grant access. The API still checks audience, scopes, roles, tenant, resource ownership, and policy.
Header, payload, and signature
A signed JWT, also called a JWS compact serialization, has three dot-separated Base64URL segments.
eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEwNDIifQ.c2lnbmF0dXJl
Header
{ "alg": "RS256", "typ": "JWT" }Names the token type and signing algorithm. The API must restrict algorithms to a trusted allowlist.
Payload
{ "sub": "user-1042", "aud": "orders-api", "exp": 1783000000 }Contains registered and application claims. It is readable and should not contain passwords or private secrets.
Signature
Sign(base64Url(header) + "." + base64Url(payload), key)Protects integrity and authenticity. It does not encrypt the payload or hide its values.
Important JWT claims explained
Registered claims provide common meanings. Private claims add application data, but both require server-side validation and authorization rules.
issIssuer
Who created the token. Accept only trusted issuers.
subSubject
The user, service, or entity represented by the token.
audAudience
The intended receiver, commonly a particular API.
expExpiration
The time after which the token must be rejected.
nbfNot before
The token must not be accepted before this time.
iatIssued at
When the issuer created the token.
jtiJWT ID
A unique identifier useful for tracing or revocation strategies.
scopePermissions
Delegated capabilities such as orders.read.
How JWT authentication commonly works
The JWT is only one part of a larger authorization and session lifecycle.
- 1
Authenticate
The user signs in or the application completes an authorization flow.
- 2
Issue
A trusted authorization server creates a short-lived access token.
- 3
Send
The client sends
Authorization: Bearer ACCESS_TOKENto the intended API. - 4
Validate
The API verifies signature, algorithm, issuer, audience, time claims, and permissions.
- 5
Refresh or sign in again
After expiry, the client may use a protected refresh token with the authorization server.
Access token
Sent to the resource API. Keep it short lived. It may be a JWT or an opaque value.
Refresh token
Sent only to the authorization server. Protect it strongly, rotate it, and support revocation.
ID token
Tells the client about an authenticated user. Do not use it as a general API access token.
Decoding is not verification
A decoded token can be fake, expired, intended for another API, or signed by an untrusted key.
- Allow only expected signing algorithms.
- Use trusted keys and support safe key rotation.
- Validate issuer and audience exactly.
- Validate exp and nbf with small clock skew.
- Apply scopes, roles, ownership, and business policy.
- Never send tokens in query-string URLs.
Where JWTs appear
Web and mobile APIs
Short-lived access tokens authorize calls to backend resources.
Single sign-on
OpenID Connect may deliver an ID token containing identity claims for the client.
Service-to-service calls
Workload identities obtain scoped tokens without representing a human user.
Signed one-time data
Short-lived signed tokens can carry bounded claims, but replay and audience controls still matter.
JWT questions and answers
Answers for developers learning token structure, authentication, validation, and session security.
What is JWT in simple words?
JWT stands for JSON Web Token. It is a compact format for carrying signed claims between systems. A JWT can identify a subject and carry authorization-related data, but the receiving system must validate it before trusting it.
Is a JWT encrypted?
Usually no. Standard signed JWT header and payload segments are Base64URL encoded and readable. Encryption requires a different form called JWE. Never place passwords or secrets in a normal JWT payload.
What are the three parts of a JWT?
A signed JWT normally contains a header, payload, and signature separated by dots. The header describes the algorithm, the payload contains claims, and the signature protects the token from undetected modification.
Can I decode a JWT without the secret?
Yes, the header and payload can usually be decoded without a key. Decoding does not prove that the token is authentic. Verification requires the trusted secret or public key and validation rules.
What is the difference between decoding and verifying a JWT?
Decoding reads the header and payload. Verification checks the cryptographic signature and validates issuer, audience, expiry, not-before time, algorithm, and application authorization rules.
Is every access token a JWT?
No. Access tokens may be JWTs or opaque random strings. Clients should treat an access token as an opaque credential unless the authorization server explicitly documents its format.
Can a refresh token be a JWT?
It can be, but many systems use opaque refresh tokens. A refresh token is a high-value secret sent only to the authorization server to obtain a new access token.
What does the exp claim mean?
The exp claim is the expiration time expressed as a NumericDate, normally seconds since the Unix epoch. A token should be rejected after this time, with only a small configured clock-skew allowance.
What are iss and aud claims?
iss identifies the trusted token issuer. aud identifies the intended audience, such as a specific API. APIs should validate both to prevent accepting a token created for another system.
Where should JWTs be stored in a browser?
There is no universal choice. Secure, HttpOnly, SameSite cookies or a backend-for-frontend are common. JavaScript-readable storage increases exposure during XSS, while cookie-based sessions require appropriate CSRF controls.
How does logout work with JWT?
The app clears its local session and normally revokes the refresh token. Short-lived JWT access tokens may remain usable until expiry unless the API performs additional server-side revocation or session checks.
Is JWT the same as OAuth 2.0?
No. JWT is a token format. OAuth 2.0 is an authorization framework, and OpenID Connect adds identity. An OAuth system can issue JWT or opaque access tokens.
Suggested tools
