JWT Explained: How JSON Web Tokens Work

JSON Web Tokens (JWTs) are everywhere in modern web authentication — log into almost any app and a JWT is probably involved. Yet they're widely misunderstood, and that misunderstanding leads to real security mistakes. Here's how they actually work, in plain terms.

What a JWT is

A JWT is a compact, self-contained token that carries information ("claims") about a user or session. After you log in, a server issues you a JWT; you send it back with each request, and the server trusts it because it's cryptographically signed. It's a way to prove "I'm authenticated" without the server storing session state.

The three parts

A JWT is three Base64URL-encoded sections separated by dots: header.payload.signature.

• Header — the token type and signing algorithm.
• Payload — the claims: user ID, roles, expiry time, and so on.
• Signature — a cryptographic seal proving the token wasn't tampered with.

Paste any token into our JWT decoder to see these parts laid out. The standard is defined in RFC 7519.

The crucial security caveat

Here's the mistake people make: the header and payload are only Base64-encoded, not encrypted. Anyone who intercepts a JWT can decode and read the payload instantly. So never put secrets — passwords, sensitive personal data — in a JWT payload. The signature prevents tampering, not reading. (See our guide on why Base64 isn't security.)

How the signature protects you

The server signs the token with a secret key. If anyone alters the payload, the signature no longer matches and the server rejects it. That's what lets the server trust a token it didn't store — it can verify authenticity mathematically.

Expiry matters

Because JWTs are self-contained, you can't easily "revoke" one before it expires. That's why well-designed tokens include a short expiry (the exp claim) and apps use refresh tokens to issue new ones. Long-lived JWTs are a security risk.

Bottom line

A JWT is a signed, self-contained token of three Base64URL parts: header, payload, and signature. The signature guarantees integrity, but the payload is readable by anyone — so keep secrets out of it, set short expiries, and decode tokens with a tool when you need to inspect them.