JSON Web Tokens Explained

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting claims between two parties. JWTs are widely used for authentication, authorization, and information exchange in modern web applications and APIs.

JWT Structure

A JWT consists of three Base64URL-encoded parts separated by dots: Header, Payload, and Signature.

header.payload.signature

// Header, algorithm & token type
{ "alg": "HS256", "typ": "JWT" }

// Payload, claims (data)
{ "sub": "1234567890", "name": "Alice", "iat": 1716239022 }

// Signature, verifies integrity
HMACSHA256(base64Url(header) + "." + base64Url(payload), secret)

Common Claims

iss: Issuer of the token
sub: Subject (usually a user ID)
aud: Intended audience
exp: Expiration time (Unix timestamp)
iat: Issued at time
nbf: Not valid before time

Signing Algorithms

HS256: HMAC with SHA-256 (symmetric, shared secret)
RS256: RSA with SHA-256 (asymmetric, public/private keys)
ES256: ECDSA with P-256 curve (compact, fast)

Common Mistakes

Storing sensitive data in the payload: JWTs are encoded, not encrypted. Anyone can read the payload.
Not validating the signature: Always verify the signature server-side before trusting claims.
No expiration: Always set exp to limit token lifetime.
Using "alg": "none": Never accept unsigned tokens in production.

Inspect and decode tokens instantly with our JWT Decoder.

FAQ

Is a JWT encrypted?

No. Standard JWTs (JWS) are signed but not encrypted. Use JWE (JSON Web Encryption) if you need to hide the payload contents.

Where should I store JWTs?

HttpOnly cookies are the most secure option for web apps. Avoid localStorage if XSS is a concern.

How do I revoke a JWT?

JWTs are stateless, you can't revoke them directly. Use short expiration times and maintain a server-side deny list for critical cases.