JWT Explained: How JSON Web Tokens Work (with Examples)

What Is a JWT?

A JSON Web Token (JWT, pronounced "jot") is a compact token used to prove who you are to an API. After you log in, the server gives you a JWT; your browser or app then sends it with every request, usually in the Authorization: Bearer ... header. The server checks it and knows who's calling — without looking up a session in a database.

JWTs are everywhere: single-page apps, mobile apps, OAuth and OpenID Connect (Google, Microsoft, Auth0 logins), communication between microservices.

The Three Parts of a JWT

A JWT looks like a long string with two dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkFsaWNlIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzU3NDk0MDAwLCJleHAiOjE3NTc0OTc2MDB9.signature

Each part is Base64URL-encoded:

1. Header — the algorithm and the token type.
2. Payload — the claims: who the user is, when the token expires…
3. Signature — proves the token hasn't been modified.

Decoded, the first two parts are simple JSON:

{ "alg": "HS256", "typ": "JWT" }

{
  "sub": "1234",
  "name": "Alice",
  "role": "admin",
  "iat": 1757494000,
  "exp": 1757497600
}

The Standard Claims

Claim	Name	Meaning
iss	Issuer	Who issued the token (your auth server)
sub	Subject	Who the token is about (usually the user ID)
aud	Audience	Which API the token is meant for
exp	Expiration	When the token stops being valid (Unix timestamp)
iat	Issued at	When the token was created
nbf	Not before	The token isn't valid before this date
jti	JWT ID	Unique identifier, useful for revocation

Dates are Unix timestamps (seconds since January 1, 1970). To read them, use the Unix timestamp converter — or let the JWT decoder do it for you.

How the Signature Works

The server computes the signature from the header, the payload and a secret key (HS256) or a private key (RS256, ES256). If someone changes a single character of the payload — say, "role": "user" to "role": "admin" — the signature no longer matches and the server rejects the token.

The signature therefore guarantees integrity (the token wasn't modified) and authenticity (it was issued by someone holding the key). It doesn't hide the content.

Decode a JWT

The JWT decoder displays the header, the payload, the claims and the expiration date in a readable form. It runs entirely in your browser: the token is never sent to a server.

The decoder doesn't verify the signature: that requires the secret or the public key, which has no place in a browser tool. Verification must be done by your server.

Common Security Mistakes

1. Storing sensitive data in the payload — it's readable by anyone.
2. Tokens that never expire — set a short exp (15 minutes to 1 hour) and use refresh tokens.
3. Accepting alg: none — always force the expected algorithm on the server side.
4. A weak HS256 secret — use a long random secret (at least 256 bits); generate one with the password generator.
5. Storing the token in localStorage without thinking — vulnerable to XSS; an HttpOnly cookie is often safer for web apps.
6. Pasting production tokens into random websites — a valid token is a key to the account. Use a tool that works locally, and prefer expired or test tokens.

Conclusion

A JWT is just three Base64URL blocks: a header, a readable payload and a signature that protects it from tampering. Understanding this structure helps you debug authentication problems in seconds — and avoid the security mistakes that turn a convenient token into a vulnerability.