A JSON Web Token (JWT, often said “jot”) is a compact, self-contained way to carry verified information between two parties — most often to prove “this user is logged in.” Instead of the server storing a session in memory, it hands the client a signed token the client sends back with each request. Understanding its three parts demystifies modern authentication.
The anatomy: three dot-separated parts
A JWT looks like xxxxx.yyyyy.zzzzz — three Base64url chunks joined by dots. The header says which signing algorithm is used. The payload holds the “claims” — data like the user ID, roles, and an expiry time. The signature is the crucial part: it is a cryptographic seal over the header and payload, created with a secret only the server knows.
Why the signature is everything
Here is the key insight people miss: the payload is not encrypted — it is only Base64-encoded, so anyone can read it (paste a token into jwt.io and you will see the claims in plain text). What the signature guarantees is integrity: if an attacker changes a single character of the payload — say, flipping "role":"user" to "admin" — the signature no longer matches, and the server rejects it. The server trusts the token because only it could have produced a valid signature.
How a login flow uses it
The user logs in with a password once; the server verifies it and returns a JWT. From then on, the client attaches that token (usually in an Authorization: Bearer header) to every request. The server validates the signature and expiry on each call — no database lookup required — which is why JWTs scale well across many servers and APIs.
The security rules that matter
Because a JWT is a bearer token, whoever holds it is treated as the user, so a few rules are non-negotiable. Never put secrets in the payload — it is readable. Always set a short expiry and use refresh tokens for long sessions. Send tokens only over HTTPS, and store them carefully on the client (an HttpOnly cookie resists cross-site scripting better than localStorage). And reject the infamous alg: none attack by pinning the expected algorithm on the server. Follow those and JWTs are a solid, standard foundation for authentication.
Frequently asked questions
Is the data inside a JWT encrypted?
No. The payload is only Base64-encoded and anyone can read it. The signature protects integrity, not secrecy — never put sensitive data in a JWT payload.
What are the three parts of a JWT?
Header (the algorithm), payload (the claims like user ID and expiry), and signature (a cryptographic seal proving the token was not tampered with).
Where should I store a JWT in the browser?
An HttpOnly, Secure cookie is generally safer than localStorage because it is not readable by JavaScript, reducing XSS risk. Always use HTTPS.
How is a JWT different from a session cookie?
A session cookie is an opaque ID that maps to server-side state; a JWT carries the state itself, signed, so the server can verify it without a lookup.