TOPIC SECURITY
JWT compact, self-contained tokens for passing identity and claims
IN 10 SECONDS
JSON Web Tokens (JWT) are base64-encoded JSON objects with a cryptographic signature. A JWT has three parts: header (algorithm), payload (claims like `sub`, `exp`, `role`), and signature. The server signs it with a secret or private key. Any service that trusts the public key can verify the token without contacting the issuer — no database lookup needed.
GOTCHA JWT is signed, not encrypted. Anyone with the token can base64-decode the payload and read its contents. Never put secrets (passwords, PII) in a JWT payload. For sensitive data, use JWE (JSON Web Encryption) or pass a reference token (opaque token) instead.
HOW A JWT IS VERIFIED
01 Auth server authenticates the user and issues a JWT: `eyJhbGciOiJIUzI1NiIs...` — signed with a secret key.
02 Client stores the JWT (localStorage, cookie, or memory) and sends it as `Authorization: Bearer <token>` on every request.
03 API server receives the request, extracts the JWT, and verifies the signature using the shared secret or public key.
04 Server reads the claims from the payload — `user_id: 42`, `role: admin`, `exp: 1719000000` — and grants or denies access.
POKE IT YOURSELF
jwt-cli decode eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqP — decode a JWT to inspect its payload
jwt-cli verify --key "my-secret" eyJhbGciOiJIUzI1NiJ9... — verify a JWT signature
Drill this topic →
~80 sec read