What is JWT? — JSON Web Tokens Explained

Definition

JWT (JSON Web Token) is an open standard (RFC 7519) that defines a compact, URL-safe way to transmit information between parties as a JSON object. The information is digitally signed, making it verifiable and trustworthy. JWTs are commonly used for authentication, authorization, and secure information exchange in web applications and APIs.

JWT Structure

A JWT consists of three parts separated by dots:

header.payload.signature

1. Header

Contains the token type and signing algorithm:

{
  "alg": "HS256",
  "typ": "JWT"
}

2. Payload

Contains claims about the user and metadata:

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "role": "admin",
  "iat": 1516239022,
  "exp": 1516242622
}

3. Signature

Created by signing the encoded header + payload with a secret key:

HMACSHA256(
  base64urlEncode(header) + "." +
  base64urlEncode(payload),
  secret
)

How JWT Authentication Works

1. User logs in with credentials (email + password)
2. Server validates credentials and creates a signed JWT
3. Server returns the JWT to the client
4. Client stores the JWT (localStorage, sessionStorage, or cookie)
5. Client sends JWT in Authorization: Bearer <token> header with requests
6. Server verifies the JWT signature and processes the request

Common JWT Claims

Signing Algorithms

Security Best Practices

1. Always use HTTPS to prevent token interception
2. Set short expiration times (15-60 minutes for access tokens)
3. Validate all claims (exp, iss, aud) server-side
4. Never store sensitive data in the payload (it's encoded, not encrypted)
5. Use strong secrets (256+ bits for HS256, 2048+ bits for RS256)
6. Implement token revocation for compromised tokens

LangStop JWT Tools

• JWT Decoder — Decode and inspect JWT tokens
• JWT Encoder — Create and sign JWT tokens