What Is a JWT (JSON Web Token)?

A JWT is a compact, encoded string used to pass verifiable claims between two parties, commonly for authentication.

Structure of a JWT

A JWT is three Base64URL-encoded segments joined by periods: `header.payload.signature`. The header typically identifies the token type and signing algorithm. The payload carries the actual claims — data such as a user ID, roles, or expiration time. The signature is generated by signing the header and payload with a secret or private key, allowing a server to verify the token hasn't been altered.

Why JWTs are popular for authentication

JWTs let a server issue a self-contained token that carries its own claims, meaning a receiving service can verify and read it without necessarily querying a central session database on every request. This makes JWTs a natural fit for stateless APIs and systems distributed across multiple services.

Decoding vs. verifying — a critical distinction

Because the header and payload are only encoded, not encrypted, anyone can decode and read a JWT's contents without any secret. That is completely different from verifying a JWT, which confirms the signature is valid and the token hasn't been tampered with — and requires the correct secret or public key. Trusting a token's claims without verifying its signature is a serious and common security mistake.

Practical security considerations

Never store sensitive secrets directly in a JWT payload, since anyone holding the token can read it. Always set and respect an expiration claim. And always verify signatures server-side using a well-maintained JWT library rather than writing your own verification logic.