What is a JWT? JSON Web Tokens explained

A JWT (JSON Web Token) is a compact way to carry claims between parties. APIs and auth systems use JWTs so a client can prove identity or permissions without the server storing a session for every request.

Three parts: header, payload, signature

A JWT is three Base64URL segments separated by dots: header.payload.signature. The header describes the token (often alg and typ). The payload holds claims such as subject, roles, and expiry. The signature binds the first two parts when verified with the right key.

What claims look like

Registered claims include sub (subject), iat (issued at), and exp (expiry), usually as Unix seconds. Apps often add custom claims for tenant ids, scopes, or feature flags. Anyone who has the token can decode the payload - it is not encrypted by default.

Decode is not the same as verify

Decoding shows what is inside. Verification proves the signature is valid for your secret or public key. Never trust claims from a token until your backend verifies it. Decode vs verify covers the difference in more detail.

Ready to inspect a token? Decode header and payload in your browser - nothing is uploaded.
Open the free JWT decoder →

Next reads: How to decode a JWT · JWT decode vs verify