A JWT, or JSON Web Token (often pronounced "jot"), is a small piece of text a server hands to a logged-in user. It states facts such as "this is user 4182, they are an admin, and this expires at 3pm", and it carries a signature so the server can later tell whether anyone has altered it.
The three parts of a token
A JWT looks like three chunks of random characters separated by dots: xxxxx.yyyyy.zzzzz.
- Header: says which signing algorithm was used, such as HS256 or RS256.
- Payload: the claims, written in JSON. Standard ones include
sub(who),exp(expiry time) andiss(who issued it). - Signature: made from the header and payload using a secret or a private key.
The first two parts are only Base64URL-encoded, not encrypted. Paste a token into a decoder like jwt.io and you can read the payload. The signature does not hide anything; it only proves the contents were not changed. The format is defined in RFC 7519.
How a JWT is used in a login
After a user signs in, the server issues a short-lived access token. The browser or app sends it with each API request, usually in an Authorization: Bearer header. The server checks the signature and expiry and trusts the claims, with no database lookup needed. Supabase, Auth0 and Firebase all issue JWTs this way, and OpenID Connect ID tokens in SSO are JWTs too.
Example: an online course platform puts "plan": "pro" in the token so its video server can decide whether to stream a lesson without calling the main database.
Do you need to know this for a small-business site?
Only if your site has logins or a custom app talking to an API. Even then, an auth provider normally handles issuing and checking tokens. It is still useful to know that a JWT is readable by anyone who holds it, which shapes what you put inside.
Common JWT mistakes
- Putting secrets or personal data in the payload, assuming the token is encrypted.
- Long expiry times. A JWT cannot easily be cancelled before it expires, so a stolen week-long token works for a week. Keep access tokens short and use refresh tokens.
- Accepting the "none" algorithm or not pinning the expected algorithm when verifying.
- Storing tokens in localStorage where any injected script can read them; an HttpOnly cookie is often safer.
Related terms
- OAuth: frequently issues access tokens as JWTs.
- JSON: the format of the header and payload.
- Cookie: one place to keep a token in the browser.
- Single sign-on: uses JWT ID tokens in OpenID Connect.