JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims to be transferred between two parties. They are widely used for authentication and information exchange in modern web applications.
JWT Structure
A JWT consists of three parts separated by dots:
Header — contains the token type (JWT) and the signing algorithm (e.g., HS256, RS256)Payload — contains the claims (user data, permissions, expiration)Signature — verifies the token hasn't been tampered with
Common Claims
sub — Subject (usually user ID)iat — Issued At (timestamp)exp — Expiration Time (timestamp)iss — Issueraud — Audience
How JWT Authentication Works
User logs in with credentialsServer validates credentials and generates a JWTJWT is sent back to the clientClient stores JWT (typically in localStorage or httpOnly cookie)Client includes JWT in Authorization header for subsequent requestsServer validates JWT signature and extracts user data
Security Best Practices
Always use HTTPS to transmit JWTsSet short expiration times and use refresh tokensStore tokens in httpOnly cookies when possibleNever store sensitive data in the payload (it's Base64 encoded, not encrypted)Validate the iss and aud claims on the serverUse strong signing algorithms (RS256 over HS256 for distributed systems)
Use our JWT Decoder to inspect the contents of any JWT token.
