What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe string used to represent claims between two parties. It consists of three Base64URL-encoded sections separated by dots: a header, a payload, and a signature. The signature allows the receiver to verify that the contents haven't been tampered with.
The three parts
Header — specifies the algorithm used to sign the token and the token type.
Payload — contains claims: facts about the user and session, such as user ID, roles, and expiry time.
Signature — a cryptographic hash of the header and payload that proves the token hasn't been modified.
Common claims
The payload typically includes: sub (the subject — usually a user ID), iat (issued at), exp (expiry timestamp), iss (issuer), and aud (intended audience).
Decoding vs verifying
Anyone can decode a JWT — the payload is only encoded, not encrypted. Use our JWT Decoder to inspect the header and payload of any token during development. Verification (checking the signature) requires the secret key and happens on your server.
Common security mistakes to avoid
- Never accept tokens with
"alg": "none"— this disables signature verification entirely - Store tokens in httpOnly cookies, not browser localStorage (which is vulnerable to cross-site scripting)
- Always validate the
expclaim — expired tokens should be rejected - Never put passwords or sensitive personal data in the payload — it can be read by anyone who has the token
Frequently Asked Questions
- How do I inspect a JWT without writing code?
- Paste the token into our JWT Decoder. It splits the token into its three sections, decodes each one, and shows the full payload including all claims and the expiry time.
- Is the JWT payload encrypted?
- No — the payload is Base64URL-encoded, which anyone can decode. Never store passwords, credit card numbers, or other sensitive data in a JWT payload.
- What is the difference between a JWT and an API key?
- An API key is an opaque string — the server must look it up in a database to know what permissions it grants. A JWT is self-contained — the server can verify it and read the permissions from the payload without a database lookup.