JWT Explained for Developers

JSON Web Tokens (JWT) are an open standard (RFC 7519) for securely transmitting information between parties as a JSON object.

Structure of a JWT

A JWT consists of three parts separated by dots (.):

header.payload.signature

1. Header: Contains the token type (JWT) and signing algorithm (HS256, RS256).
2. Payload: Contains claims (user IDs, scopes, expiration exp).
3. Signature: Cryptographic hash verifying the token hasn't been altered.

Security Warning: Decoding vs Verification Decoding a JWT parses the Base64URL string into readable text. Anyone who intercepts a JWT can decode its contents. **Never put unencrypted secret passwords or API tokens inside JWT payloads!**