What Is a JWT? JSON Web Tokens Explained

A JWT (JSON Web Token) is a compact way to pass verified information between two parties, commonly used to prove a user is logged in without the server needing to look anything up in a database on every request.

What Is a JWT?

A JWT is a string made of three parts separated by dots: header.payload.signature. Both the header and payload are What Is JSON? objects, each converted to text using a URL-safe variant of What Is Base64 Encoding?. The signature is what makes the token trustworthy, described further below.

The Three Parts

{"alg":"HS256","typ":"JWT"}

{"sub":"1234567890","name":"John Doe","iat":1516239022}

What the Signature Actually Verifies

The signature proves the token hasn’t been tampered with since it was issued, since changing even one character of the header or payload would produce a different signature. It does not encrypt the payload; anyone can decode the header and payload and read them directly.

Common Mistakes

• Assuming a JWT is encrypted. It’s signed, not encrypted. The header and payload are just Base64URL-encoded JSON, readable by anyone who decodes them, never put secret data in a JWT payload.
• Skipping signature verification. A JWT’s payload can be read by anyone, but only a system with the correct secret key can verify the signature is genuine; systems that decode a JWT without verifying its signature can be fooled by a forged token.
• Storing a JWT somewhere insecure. Since anyone holding a valid JWT can typically use it to authenticate, it needs to be protected in transit and storage much like a password would be.

Use the JWT Decoder

The JWT Decoder decodes a JWT’s header and payload instantly, so you can inspect its contents directly.