JWT Tokens Explained - Structure and Security
Understand JSON Web Tokens (JWT): their three-part structure, how signing works, common security pitfalls, and best practices.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. JWTs are widely used for authentication and authorization in modern web applications, APIs, and microservices architectures.
JWT Structure: Three Parts
Every JWT consists of three Base64URL-encoded parts separated by dots: header.payload.signature
- Header - Contains the token type (JWT) and signing algorithm (e.g., HS256, RS256)
- Payload - Contains claims — statements about the user and metadata like expiration time (exp), issued at (iat), and subject (sub)
- Signature - Created by signing the header and payload with a secret key, ensuring the token hasn't been tampered with
Inspect and decode any JWT instantly with our JWT Decoder. It parses the header, payload, and shows expiration status without needing the secret key.
How JWT Authentication Works
The server creates a signed JWT after login and sends it to the client. The client includes this token in subsequent API requests via the Authorization header. The server verifies the signature to authenticate the request without querying a database.
JWT Security Best Practices
- Set short expiration times - Use 15-minute access tokens with refresh tokens
- Use strong secrets - At least 256 bits for HMAC algorithms
- Never store sensitive data - The payload is encoded, not encrypted
- Validate all claims - Check exp, iss, aud on every request
The payload is simply Base64URL-encoded, which is easily reversible. Test this yourself with our Base64 Encoder/Decoder to see that encoding is not encryption.