What is JWT? Complete Guide to JSON Web Tokens

Introduction to JWT

JWT (JSON Web Token) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

Compact

Small size makes JWTs easy to send through URLs, POST parameters, or HTTP headers

Secure

Digitally signed using HMAC or RSA to verify authenticity and integrity

JWT Structure

A JWT consists of three parts separated by dots (.):

xxxxx.yyyyy.zzzzz

xxxxx = Header

yyyyy = Payload

zzzzz = Signature

1. Header

Contains the token type (JWT) and signing algorithm (e.g., HS256, RS256)

{
  "alg": "HS256",
  "typ": "JWT"
}

2. Payload

Contains the claims - statements about an entity and additional data

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

3. Signature

Created by encoding the header and payload with a secret, ensuring the token hasn't been tampered with

Common JWT Claims

iss - Issuer

Who created and signed the token

sub - Subject

Who the token is about (typically user ID)

aud - Audience

Who the token is intended for

exp - Expiration

When the token expires (Unix timestamp)

iat - Issued At

When the token was created

Why Use JWT?

•Stateless: No server-side session storage needed
•Scalable: Easy to scale horizontally
•Cross-domain: Works across different domains
•Mobile-friendly: Perfect for mobile apps and SPAs

Try Our JWT Debugger

Now that you understand JWT, decode and validate your tokens with our advanced tool!