JWT (JSON Web Token, RFC 7519) is a compact, URL-safe token format containing claims encoded as JSON and cryptographically signed (or optionally encrypted). It’s the workhorse of modern API authentication, OAuth 2.0 access tokens, and stateless session management.
Structure
Three base64url-encoded segments joined with dots:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.SflKxwRJSMeKKF2QT4fwpMe...
↑ header ↑ payload ↑ signatureDecoded header:
{ "alg": "HS256", "typ": "JWT" }Decoded payload:
{ "sub": "1234567890", "name": "Alice", "iat": 1516239022, "exp": 1516242622 }Standard Claims
| Claim | Purpose |
|---|---|
iss | Issuer |
sub | Subject (usually user ID) |
aud | Audience |
exp | Expiration timestamp |
iat | Issued at |
nbf | Not before |
jti | JWT ID (for revocation) |
Signed vs Encrypted
- JWS (JSON Web Signature) — signed but readable.
HS256,RS256,ES256. Anyone can read the payload; only the holder of the key can produce a valid signature. - JWE (JSON Web Encryption) — encrypted. Payload not readable without the key.
Most JWTs are JWS. If you have secrets in a JWT, use JWE — otherwise the client can read them.
Common Miss
- Storing secrets in the payload — JWS payload is base64, not encrypted
- Accepting
alg: none— some old libraries did; always allowlist expected algorithms - Not verifying
exp— token stays valid forever
Decode and inspect any JWT with the JWT decoder.
Related
Check the JWS glossary entry, the JWK glossary entry, and read the What Is a JWT? deep dive.