JWT
A JWT, or JSON Web Token, is a compact string that carries a set of claims such as who a user is and when their session expires. It has three parts separated by dots, a header, a payload, and a signature. The signature lets a server confirm the token was not tampered with.
Why JWTs exist
Web apps need a way to remember that you logged in without asking for your password on every click. A JWT solves that. After you sign in, the server hands your app a signed token, and the app presents it on later requests as proof of who you are.
The clever part is the signature. Anyone can read a JWT, but only the server holding the secret key can produce a valid signature, so a tampered token is rejected immediately.
How to read one safely
You will often want to see what a token actually contains while debugging.
- Open the JWT decoder.
- Paste the token to see its header and payload in plain text.
- Check the claims and expiry without sending the token anywhere.
The decode happens entirely in your browser, which matters because a live token is a key to an account, not just a piece of text.
The parts of a token
A JWT is three pieces of base64url text joined by dots. The first is the header, which names the signing algorithm. The second is the payload, a JSON object of claims. The third is the signature. Several claim names are standard: exp is when the token expires, iat when it was issued, nbf the time before which it must not be accepted, iss who issued it, aud who it is for, and sub who it is about. Times are counted in seconds since 1 January 1970.
Reading a token and trusting it are different steps. Anyone can decode the header and payload, because they are only encoded, not encrypted. Only the server that holds the secret or public key can check the signature, and a token that has not been checked tells you what someone wrote, not what is true.
Frequently asked questions
What are the three parts of a JWT?
A header describing the algorithm, a payload holding the claims, and a signature. The header and payload are Base64url-encoded JSON, so they are readable by anyone. The signature is what proves the token is authentic.
Is the data inside a JWT encrypted?
No. A standard JWT is signed, not encrypted, so anyone with the token can read the payload. Never put secrets like passwords in a JWT, and never trust its contents until you have verified the signature.
Why should I not paste a JWT into a random website?
A token often grants access to an account. Pasting it into an unknown site can hand that access to a stranger. Decode tokens locally so the value never leaves your browser.