What Is a JWT Token? (Structure and How It Works)
JWTs are the quiet workhorse of modern authentication. They look like three dot-separated strings but encode an identity claim plus a signature. This guide decodes the structure, shows what is protected and what is not, and explains how to inspect one safely.
What are the three dot-separated parts of a JWT?
A JWT is header.payload.signature. The header usually records the signing algorithm and type. The payload holds claims like sub (subject), iat (issued at), and exp (expiration). The signature is the part that lets a server verify the token was not tampered with.
What is signed and what must stay secret?
Only the signature proves integrity. The header and payload are encoded, not encrypted, so anyone can read their content. Never put secrets in a JWT payload. The signature is computed with a secret key (HS256) or a public/private key pair (RS256) known only to the server.
How is a JWT used?
A client receives a token after logging in and sends it with each request, usually in an Authorization header. The server verifies the signature and the claims, then trusts the identity without looking the user up again. That statelessness is why JWTs scale well across many services.
How do you read expiration and validation in a JWT?
The exp claim tells you when a token stops being valid, and iat when it began. A decoder converts these timestamps into readable dates so you can tell at a glance whether a token is expired, issued recently, or already stale.
How do you decode a JWT without compromising it?
You only need the payload and header to inspect a token, which makes decoding safe as long as you keep it in your browser. Decode the header, payload, and signature of any token with the JWT decoder, which converts the expiry dates and highlights the JSON.