What Is a JWT Token? Structure and How It Works
A JWT token carries login information between apps. Learn its three parts, how authentication works, and how to decode one.
A JWT token (JSON Web Token) is a compact, self-contained way to securely carry information between two parties — most often to prove that a user is logged in. If you build or use modern web apps and APIs, you meet JWTs constantly, so it helps to know exactly what they contain.
What a JWT is for
When you sign in to a site, the server can hand your browser a signed token instead of storing your session on its own database. On each later request your app sends the token back, and the server trusts it because the signature proves it has not been tampered with. This makes JWTs popular for stateless authentication across APIs and microservices.
The three parts of a JWT
A JWT is three Base64 sections joined by dots: header.payload.signature.
| Part | What it contains |
|---|---|
| Header | The token type and signing algorithm. |
| Payload | The claims — user id, expiry, roles. |
| Signature | A cryptographic seal that verifies the token. |
What lives in the payload
- sub — the subject, usually the user's id.
- exp — the expiry time, after which the token is invalid.
- iat — when the token was issued.
- Custom claims such as roles or permissions.
A key safety point
The header and payload are only Base64-encoded, not encrypted — anyone can read them. Never put passwords or secrets inside a JWT payload.
How to inspect a token
Because the readable parts are just Base64, you can decode any token to see its contents. Our JWT decoder splits a token and shows the header and payload as clean JSON, entirely in your browser, and if you want to understand the underlying encoding first, the Base64 tool shows how each part is built. The formal specification is RFC 7519. Decode a real token once and the structure will click immediately.