JWT Explained: How JSON Web Tokens Work

Last updated: 23 July 2026 · 6 min read

JSON Web Tokens (JWTs) are everywhere in modern web authentication — logins, API keys, single sign-on. They look like an intimidating string of gibberish, but the idea is simple. A JWT is a compact, self-contained way to carry a set of claims (facts) that a server can verify without looking anything up in a database.

The three parts

A JWT is three Base64URL-encoded sections joined by dots: header.payload.signature.

Header — says what type of token it is and which signing algorithm was used (for example HS256 or RS256).
Payload — the claims: who the user is, when the token expires, and any custom data.
Signature — a cryptographic signature over the header and payload, created with a secret or private key.

You can read the header and payload of any JWT — they are only encoded, not encrypted (see our guide on encoding vs encryption). Try it with the JWT Decoder, which shows the header, payload and expiry without sending the token anywhere.

Common claims

sub — the subject (usually the user ID).
iat — issued-at time.
exp — expiry time; after this the token is invalid.
iss / aud — who issued the token and who it is for.

How verification works

When a server receives a JWT, it recomputes the signature over the header and payload using its key and checks it matches the signature in the token. If someone tampers with the payload — say, changing their user ID — the signature no longer matches and the token is rejected. This is why the signature, not the encoding, is what makes a JWT trustworthy.

Security tips

Never put secrets in the payload. Anyone can read it. Store only non-sensitive claims.
Always set an expiry (exp). Short-lived tokens limit the damage if one leaks.
Verify the algorithm. Reject tokens using none or an unexpected algorithm.
Use HTTPS so tokens are not intercepted in transit.

In short

A JWT carries verifiable claims in three parts — header, payload and signature. The signature guarantees integrity; the encoding is just for safe transport. To inspect one, use the free JWT Decoder.