What Is a JWT (JSON Web Token)? Explained Simply
A JWT is a compact, signed token used to securely transmit claims like user identity between parties. Learn its three-part structure and how verification works.
Published September 22, 2026
A JWT (JSON Web Token) is a compact, URL-safe token format consisting of three Base64URL-encoded parts separated by dots: a header, a payload (claims, like user ID and expiry), and a signature that lets the receiver verify the token wasn't tampered with.
Common causes
- Stateless authentication needs a way to prove a user's identity on every request without the server storing session data — a signed token that carries its own claims solves this without a server-side lookup
How to fix it
- Issue a JWT when a user logs in, signed with a secret (HMAC) or private key (RSA/ECDSA) only the server controls
- On each subsequent request, verify the signature server-side before trusting any claim inside the token — never trust the payload's contents without verifying the signature first
- Set a short expiry (exp claim) on JWTs used for authentication, since a compromised token remains valid until it expires — there's no built-in server-side revocation
Example
// Structure: header.payload.signature
eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOjF9.4Adcj3UFYzPUVaVF43FmMab6RlaQD8A9V8wFzzht-KQFAQ
Can anyone read the contents of a JWT?
Yes — the header and payload are only Base64URL-encoded, not encrypted, so anyone can decode and read them. The signature only proves the token wasn't tampered with; it doesn't hide the payload's contents.