What Is a JWT (JSON Web Token)?

A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and authorization in web applications and APIs. Instead of storing session data on the server, JWTs carry user identity and permissions inside the token itself.

JWT structure

Every JWT has three parts separated by dots: Header.Payload.Signature. The header describes the token type and signing algorithm (HS256, RS256, etc.). The payload contains claims (user ID, roles, expiration). The signature verifies the token has not been tampered with.

Decode vs verify vs sign

• Decode — read header and payload claims (does not prove authenticity)
• Verify — check the signature with a secret (HMAC) or public key (RSA)
• Sign — create a new token with custom claims and a shared secret

When to use JWTs

• Stateless API authentication (REST, GraphQL)
• Single sign-on (SSO) between services
• Mobile app authentication
• Microservices identity propagation

Important security notes

• JWTs are encoded, not encrypted — anyone can decode the payload
• Never store sensitive data (passwords, credit cards) in JWT payloads
• Always verify signatures on the server before trusting claims
• Set short expiration times and use refresh tokens for long sessions