JWT Tokens Explained — Complete Guide
Everything you need to know about JSON Web Tokens: structure, signing algorithms, verification, and best practices. Includes a free online JWT parser.
What is a JWT?
JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and authorization in web applications and APIs.
A JWT consists of three parts: Header, Payload, and Signature, separated by dots. The structure looks like: xxxxx.yyyyy.zzzzz
JWT Structure Explained
Header: Contains the token type ('JWT') and the signing algorithm (e.g., HS256, RS256). The header is Base64Url encoded.
Payload: Contains claims — statements about the entity (usually the user) and additional metadata. Common claims: 'sub' (subject), 'iat' (issued at), 'exp' (expiration), 'iss' (issuer).
Signature: Created by encoding the header and payload with a secret (HMAC) or private key (RSA/ECDSA). The signature verifies that the token has not been tampered with.
JWT Best Practices
Always use HTTPS to prevent token interception during transmission.
Set appropriate expiration times ('exp') — short-lived tokens (15-60 minutes) for access, longer for refresh tokens.
Never store sensitive data in the payload — it is Base64 encoded, not encrypted.
Validate the signature on every request using the correct secret or public key.
Use the 'aud' (audience) and 'iss' (issuer) claims to restrict token usage to specific services.