What is JWT (JSON Web Token)?
A JSON Web Token (JWT) is a compact, URL-safe token made of three Base64URL-encoded parts — header, payload, and signature — separated by dots. It carries "claims" (such as a user ID and expiry) and is commonly used for stateless authentication and authorization.
The signature lets the recipient verify the token was not tampered with. Note that the payload is only encoded, not encrypted, so never put secrets in a JWT.
Key points
- A JWT has three Base64URL parts — header, payload, signature — separated by dots.
- The signature lets the receiver verify the token has not been altered.
- The payload is encoded, not encrypted — never store secrets in it.
- Tokens usually include an exp (expiry) claim and must be validated server-side.
Example
header.payload.signature eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.<signature>
Common uses
- Stateless authentication after login (bearer tokens)
- Authorizing API requests without server-side sessions
- Single sign-on (SSO) and OpenID Connect ID tokens
- Short-lived signed links such as password resets
Work with JWT (JSON Web Token) directly in your browser.
Open the JWT Decoder