Understanding JWT (JSON Web Tokens)

JSON Web Tokens (JWT) are an open standard (RFC 7519) that define a compact and self-contained way for securely transmitting information between parties as a JSON object.

The Structure of a JWT

A JWT consists of three parts separated by dots (.):

1. Header: Contains the type of token (JWT) and the signing algorithm being used (e.g., HMAC SHA256 or RSA).
2. Payload: Contains the claims (statements about an entity and additional data). This is where the user ID, roles, and expiration dates live.
3. Signature: Used to verify the message wasn't changed along the way.

Why Use JWTs?

The primary benefit of JWTs is stateless authentication. Because the token itself contains all necessary information to identify the user, the backend server doesn't need to query a database or cache to validate a session on every single request. This makes scaling microservices and APIs much easier.

Decoding JWTs

It's important to remember that the Header and Payload of a standard JWT are merely Base64Url encoded, NOT encrypted. Anyone who intercepts the token can decode it and read the payload. Therefore, you should never put sensitive data (like passwords or SSNs) inside the payload.

Need to inspect the contents of a token during development? Use our offline JWT Decoder to safely view headers and payloads without pasting your tokens into third-party servers.