What Is JWT? JSON Web Token Explained

What Does JWT Stand For?

JWT stands for JSON Web Token. It's an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe string. The information is JSON-encoded and digitally signed so receivers can verify it hasn't been tampered with.

Why JWT Is Used

• Stateless authentication — servers don't need to store session data
• Self-contained — the token carries all necessary user information
• Cross-domain — works across different services and microservices
• Compact — small enough to send in HTTP headers and URLs
• Standardized — supported by every major platform and language

JWT Structure

A JWT consists of three parts separated by dots (.), each Base64URL-encoded:

1. Header — contains the token type (JWT) and signing algorithm (e.g. HS256, RS256)
2. Payload — contains claims (user data like ID, email, roles, expiration time)
3. Signature — verifies the token wasn't modified, created using the header, payload, and secret key

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWII6MTIzNDU2Nzg5MCwibmFtZSI6IkpvaG4In0.signature

Common JWT Claims

• iss (Issuer) — who created the token
• sub (Subject) — who the token is about (usually user ID)
• aud (Audience) — who the token is intended for
• exp (Expiration) — when the token expires (Unix timestamp)
• iat (Issued At) — when the token was created
• Custom claims — app-specific data like roles, permissions, email

How JWT Authentication Works

1. User logs in with credentials
2. Server validates credentials and creates a signed JWT
3. Client stores the JWT (cookie, localStorage, or memory)
4. Client sends JWT with every subsequent request (Authorization header)
5. Server verifies the signature and reads claims — no database lookup needed

Decode JWT Tokens Online

During development, you often need to inspect JWT contents — check expiration, debug claims, or verify token structure. Our free JWT Decoder lets you paste any token and instantly view the header, payload, and expiration status.