In this article
Log in to many apps and the server hands you a token that looks like xxxxx.yyyyy.zzzzz. That is a JWT. It is the app's way of saying, without looking anything up, “this person was already checked.” Understanding what is inside makes login bugs much easier to fix.
The three parts
- 1HeaderSays which algorithm signed it, for example HS256 or RS256, and that the type is JWT
- 2PayloadThe claims: who the user is, who issued it, and when it expires
- 3SignatureA fingerprint made with a secret or private key. Change one character in the first two parts and it stops matching
The first two parts are Base64URL text. A browser or a decoder tool can read them in a blink.
The claims you will see
| Claim | Meaning | Example |
|---|---|---|
sub | Subject: who the token is about | A user ID |
iss | Issuer: who created it | Your auth server's address |
aud | Audience: who it is meant for | Your API |
exp | Expiry time, as a Unix timestamp | 1790000000 |
iat | Issued-at time | Unix timestamp |
nbf | Not valid before this time | Unix timestamp |
jti | A unique ID for this token | Random string |
Times are Unix seconds. See Unix time for how to read them.
Decoding is not verifying
Your server must verify every token on every request. A decoder tool is for reading, not for trusting.
Why “it is just encoded” matters
- Tamper-evident
- Self-contained: the server needs no lookup
- Anyone holding it can read it
- Not encrypted by default, so no passwords or private data inside
If you need the contents hidden, use an encrypted token (JWE) or keep the data on the server and send only an ID.
Common JWT mistakes
- Not checking `exp`. Without it, a stolen token works forever.
- Accepting `alg: none`. Always pin the allowed algorithms on the server.
- Long expiry for everything. Keep access tokens short, refresh them with a separate token.
- Storing tokens where scripts can read them. If a page can be injected, the token can be stolen.
- Pasting a live token into random websites. Use a tool that decodes locally, and treat real tokens like passwords.
Questions people ask
What is a JWT?
A JSON Web Token: a signed string made of a header, a payload of claims and a signature, joined by dots. Servers use it to prove a user was already authenticated.
Is a JWT encrypted?
Not by default. The header and payload are only Base64URL-encoded, so anyone can read them. The signature only prevents tampering.
What is the difference between decoding and verifying a JWT?
Decoding just reads the contents and needs no key. Verifying recomputes the signature with the key to prove the token is genuine and unaltered.
What does exp mean in a JWT?
The expiry time, as a Unix timestamp in seconds. After that moment the token must be rejected.
Is it safe to paste a JWT into an online decoder?
Only if the tool decodes in your browser and you are not sending a live production token to a service you do not trust. Treat real tokens like passwords.