What is JWT
Learn what JSON Web Tokens are, how they work, and their role in modern authentication and authorization.
1. What is JWT
JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties as a JSON object. A JWT consists of three parts separated by dots: the header, the payload, and the signature. The header typically contains the algorithm used for signing (such as HS256 or RS256) and the token type. The payload contains claims, which are statements about an entity (usually the user) and additional data. Common claims include issuer, subject, audience, and expiration time. The signature is computed by encoding the header and payload, then signing them with a secret key or private key. This signature ensures that the token has not been tampered with during transmission.
2. Why It Matters
JWT has become the standard for authentication in modern web applications, especially single-page apps and APIs. Unlike traditional session-based authentication, JWT is stateless, meaning the server does not need to store session data. This makes JWT ideal for distributed systems, microservices, and APIs that need to scale horizontally. Understanding JWT is crucial for building secure authentication systems and avoiding common security vulnerabilities.
3. Example
// Header
{
"alg": "HS256",
"typ": "JWT"
}
// Payload
{
"sub": "user123",
"name": "John Doe",
"exp": 1717209600
}
// Token (encoded)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwibmFtZSI6IkpvaG4gRG9lIiwiZXhwIjoxNzE3MjA5NjAwfQ.xxxA JWT has three parts: header (algorithm info), payload (user data and claims), and signature (for verification). Each part is Base64URL encoded and separated by dots.
4. Common Mistakes
1. Storing sensitive data in payload
The JWT payload is Base64 encoded, not encrypted. Anyone can read it. Never store passwords or other sensitive data in the payload.
2. Not setting expiration
Always set an expiration time for JWTs. Long-lived or never-expiring tokens are a security risk.
3. Using weak algorithms
Avoid using none algorithm and prefer asymmetric algorithms like RS256 for better security.
4. Not validating on server
Always validate and verify JWT signatures on the server. Never trust client-side validation alone.
5. Related Tools
FAQ
Try Our Free Developer Tools
Put your knowledge into practice with our free online developer tools. All tools work directly in your browser with no installation required.