What Is a JWT and How Does It Actually Work

JWT (JSON Web Token) is the backbone of modern web authentication — the token your server hands you after login is almost always a JWT. Let's break down how it works.

The three parts of a JWT

A JWT is made of three parts separated by dots (.): Header.Payload.Signature

• Header — states the token type and signing algorithm (e.g. HS256)
• Payload — the actual data (claims), like user ID, expiry time, roles
• Signature — verifies the token hasn't been tampered with, generated using the server's secret key

The Header and Payload are only Base64URL-encoded, not encrypted — meaning anyone can decode and read them. Never put a password or other sensitive data directly into a JWT payload.

How JWT is used in authentication

After a successful login, the server issues a signed JWT. The client sends this token with every request (usually in the Authorization header). The server only needs to verify the signature — no database lookup required — which is what makes JWT-based auth stateless and fast.

How to decode a JWT

When debugging, you usually just need to see what's inside the token — check the expiry, verify a claim. Our JWT Decoder does exactly that: paste the token, and the header and payload show up as readable JSON instantly — entirely in your browser, the token is never sent to a server.