What is JWT? Complete Guide with Examples

3 min readdeveloper

Last updated: Invalid Date

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, self-contained JSON object. A JWT consists of three Base64URL-encoded parts separated by dots: header.payload.signature. JWTs are widely used for authentication and authorization in web applications, enabling stateless session management where the server doesn't need to store session data.

Try It Yourself

Use our free JWT Decoder to experiment with json web tokens.

JWT Decoder

How Does JSON Web Tokens Work?

The header specifies the token type (JWT) and signing algorithm (HS256, RS256). The payload contains claims — statements about the user (sub, name, admin) and metadata (iss, exp, iat). The signature is created by encoding the header and payload, then signing with a secret key (HMAC) or private key (RSA/ECDSA). Verification involves recomputing the signature and comparing it to the token's signature. If they match, the payload hasn't been tampered with and was signed by the expected party.

Key Features

Three-part structure: Base64URL-encoded header, payload, and cryptographic signature
Stateless authentication — servers verify tokens without database lookups
Standard claims: iss (issuer), sub (subject), exp (expiration), iat (issued at), aud (audience)
Support for HMAC (symmetric) and RSA/ECDSA (asymmetric) signing algorithms
Compact format suitable for HTTP headers, URL parameters, and cookies

Common Use Cases

API Authentication

After login, the server issues a JWT. Clients include it in the Authorization header (Bearer token) of subsequent API requests. The server verifies the signature and extracts the user identity without database queries.

Single Sign-On (SSO)

JWTs enable SSO across multiple services. A user authenticates with one service and receives a JWT that other services in the ecosystem can verify and accept, using shared or published public keys.

Microservice Authorization

In microservice architectures, JWTs propagate user identity and permissions across service boundaries. Each service independently verifies the token's signature without calling the auth service.

Why JSON Web Tokens Matters

Understanding json web tokens is essential for anyone working in software development. It is not just a theoretical concept — it directly impacts the quality, efficiency, and reliability of your work. Professionals who understand the underlying principles make better decisions about which tools and approaches to use.

Whether you are a beginner learning the fundamentals or an experienced professional looking for a quick refresher, grasping how json web tokens works helps you debug issues faster, communicate more effectively with your team, and choose the right tool for each specific task.

Getting Started with JSON Web Tokens

The fastest way to learn json web tokens is to experiment with it hands-on. Use our free tools linked above to try different inputs and see how the output changes. Start with simple examples, then gradually increase complexity as you build intuition for how json web tokens behaves.

For deeper learning, explore the related guides linked at the bottom of this page — they cover adjacent concepts that will strengthen your understanding of the broader ecosystem. Each guide includes practical examples and links to tools you can use immediately.

Frequently Asked Questions

Is JWT encrypted?

Standard JWTs (JWS) are signed but NOT encrypted — the payload is Base64URL-encoded and can be decoded by anyone. Don't put sensitive data in the payload. For encrypted payloads, use JWE (JSON Web Encryption), which adds an encryption layer.

How do I handle JWT expiration?

Set short expiration times (15-60 minutes) for access tokens. Use refresh tokens (stored securely, with longer lifetimes) to obtain new access tokens without re-authentication. Always check the exp claim before trusting a token.

What is the difference between HS256 and RS256?

HS256 (HMAC-SHA256) uses a shared secret key for both signing and verification — all parties need the same secret. RS256 (RSA-SHA256) uses a private key for signing and a public key for verification — only the issuer needs the private key, and verifiers use the published public key.

Can JWTs be revoked?

JWTs are stateless by design, so you can't invalidate an issued token without maintaining state. Common revocation strategies include short expiration times, token blacklists (checked on each request), and rotating signing keys. Each approach trades off between statefulness and security.

Related Tools

JWT Decoder

Was this page helpful?

Written by

Tamanna Tasnim

Senior Full Stack Developer

ToolsContainerDhaka, Bangladesh5+ years experiencetasnim@toolscontainer.com www.toolscontainer.com

Full-stack developer with deep expertise in data formats, APIs, and developer tooling. Writes in-depth technical comparisons and conversion guides backed by hands-on engineering experience across modern web stacks.

All Guides All Tools