JWT

JWT (JSON Web Token) is an open standard (RFC 7519) that defines a compact, self-contained way to securely transmit information between parties as a JSON object. The token is digitally signed, so the recipient can verify that the data hasn't been altered and comes from a trusted issuer. JWT is now a foundation of stateless authentication in web applications and APIs.

How a JWT is structured

A token consists of three parts separated by dots, each Base64URL-encoded:

• header — states the token type and signing algorithm, e.g. HS256 or RS256;
• payload — carries the claims: a user identifier, roles, an expiry time (exp), the issuer (iss);
• signature — produced by hashing the header and payload with a secret or private key; this is what guarantees integrity.

When the server receives a token, it recomputes the signature with its own key and compares it to the one in the token. A match means the payload is authentic — with no need to query a database for a session.

Practical application

The most common scenario is login: after successful authentication the server issues a JWT, which the client attaches to subsequent requests in an Authorization: Bearer header. The server validates the token on every request without keeping session state, which simplifies horizontal scaling and microservice architectures. JWTs also serve as access tokens and ID tokens in OAuth 2.0 and OpenID Connect flows.

Using them safely takes discipline: short token lifetimes, enforcing a strong algorithm (rejecting alg: none), transmitting only over HTTPS and a well-designed refresh and revocation mechanism. Because the payload is merely encoded rather than encrypted, you never place passwords or other sensitive data inside it.