What Is a JWT (JSON Web Token)?
Understand JSON Web Tokens — how they work, their structure, and when to use them for authentication.
A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and authorization in web applications and APIs. Instead of storing session data on the server, JWTs carry user identity and permissions inside the token itself.
JWT structure
Every JWT has three parts separated by dots: Header.Payload.Signature. The header describes the token type and signing algorithm. The payload contains claims (user ID, roles, expiration). The signature verifies the token has not been tampered with.
When to use JWTs
- Stateless API authentication (REST, GraphQL)
- Single sign-on (SSO) between services
- Mobile app authentication
- Microservices identity propagation
Important security notes
- JWTs are encoded, not encrypted — anyone can decode the payload
- Never store sensitive data (passwords, credit cards) in JWT payloads
- Always verify signatures on the server before trusting claims
- Set short expiration times and use refresh tokens for long sessions