What Is a JWT? JSON Web Token Structure, Signing, and Security Explained

A JWT (JSON Web Token, RFC 7519) is a compact, URL-safe, self-contained token that carries a set of claims — statements about a user or session — signed by an issuer. It’s the workhorse of modern API authentication and OAuth 2.0.

Read this if you’re building an API, integrating with an OAuth provider, or debugging why your production login endpoint returns 401.

Structure — Three Segments

Every JWT has three base64url-encoded segments joined with dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.SflKxwRJSMeKKF2QT4fw...
   ↑ header                         ↑ payload           ↑ signature

Decode segments 1 and 2 with any base64 decoder — no key needed.

Header

{ "alg": "HS256", "typ": "JWT" }

• alg — signing algorithm (HS256, RS256, ES256, EdDSA)
• typ — always JWT for JWTs
• kid — optional key ID pointing to the JWK that verifies the signature

Payload — the Claims

{
  "sub": "user-42",
  "iss": "https://auth.example.com",
  "aud": "https://api.example.com",
  "exp": 1735689600,
  "iat": 1735686000,
  "role": "admin"
}

Standard claims (RFC 7519):

Custom claims (role, tenant_id, permissions) go alongside — but keep them minimal because every byte gets sent on every request.

Signature

The signature covers {base64(header)}.{base64(payload)} — protecting them from tampering:

• HS256 — HMAC(secret, header + '.' + payload) — symmetric, shared secret
• RS256 — RSA signature over SHA-256 hash — asymmetric, private key signs, public key verifies (via a JWK)
• ES256 — ECDSA over the P-256 curve — asymmetric, smaller signatures than RS256
• EdDSA — Edwards-curve signature (Ed25519) — asymmetric, fastest verification

Anyone can read the payload; only holders of the key can forge a valid signature.

Common Vulnerabilities

• alg: none — old libraries accepted this. Always allowlist expected algorithms server-side.
• Symmetric-key confusion — sending a public RSA key to a lib that expected HMAC. Result: the public key is the “secret” and the whole world can forge tokens.
• Missing exp validation — token remains valid forever.
• Trusting alg from the token header — attacker picks the algorithm. Server should pin the expected algorithm.
• Storing secrets in the payload — remember: JWS payload is public.

JWT vs Session Cookies

Revocation Strategies

• Short expiry (5-15 min) + refresh token — most common. Access token expires quickly; a longer-lived refresh token stored server-side gets new access tokens.
• JTI revocation list — every token has a jti; check against a fast KV store on verify.
• Session-tied JWT — verify against a server-side session record.

Tools

• Paste any JWT into the JWT decoder to inspect header, payload, and signature format.
• Generate signed JWTs for testing with the JWT generator.
• Understand the underlying hashes with the SHA-256 and SHA-512 glossary entries.

Related

Check the JWT glossary entry, the JWS entry, and the JWK entry for signature-verification key discovery.