Understanding JWT Structure and Security

What is JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

JWTs are commonly used for authentication and information exchange in modern web applications. When a user logs in, the server generates a JWT containing user information and permissions, which the client stores and sends with subsequent requests.

JWT Structure

A JWT consists of three parts separated by dots (.):

xxxxx.yyyyy.zzzzz

1. Header

The header typically consists of two parts: the type of token (JWT) and the signing algorithm being used (e.g., HMAC SHA256, RSA).

{
  "alg": "HS256",
  "typ": "JWT"
}

2. Payload

The payload contains the claims. Claims are statements about an entity (typically, the user) and additional data. There are three types of claims: registered, public, and private claims.

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iat": 1516239022,
  "exp": 1516242622
}

3. Signature

The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way.

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret
)

Common JWT Claims

iss (Issuer)

Identifies who issued the JWT

sub (Subject)

Identifies the subject of the JWT (usually user ID)

aud (Audience)

Identifies the recipients the JWT is intended for

exp (Expiration Time)

When the JWT expires (timestamp)

iat (Issued At)

When the JWT was issued (timestamp)

nbf (Not Before)

The JWT should not be accepted before this time

Security Best Practices

✓

Use HTTPS: Always transmit JWTs over secure connections to prevent interception.

✓

Set Short Expiration Times: Limit token lifetime to reduce risk if compromised.

✓

Validate Claims: Always verify iss, aud, and exp claims on the server.

✓

Don't Store Sensitive Data: Remember that JWT payload is only base64-encoded, not encrypted.

✗

Never use "none" algorithm: This disables signature verification entirely.

✗

Don't store in localStorage without caution: Consider XSS vulnerabilities; httpOnly cookies may be safer.

⚠️ Security Disclaimer

This guide provides educational information about JWTs. Always consult security best practices and consider your specific use case when implementing authentication. JWTs are not encrypted by default—only signed. Never include sensitive information like passwords or credit card numbers in JWT payloads.

Try It Yourself

Want to decode and inspect JWTs? Try our free JWT Decoder Tool to analyze token structure, verify signatures, and understand claims.

Need to validate data formats? Check out JSON Validator Pro for comprehensive JSON validation and schema checking.