Home › Blog › JWT Explained

JWT Authentication Explained: How JSON Web Tokens Work

May 7, 2026 • 9 min read • Try the free JWT Decoder →

JSON Web Tokens (JWTs) are everywhere in modern web development — used for authentication, authorization, and secure information exchange between services. Yet many developers use them without fully understanding how they work, which leads to security vulnerabilities and incorrect implementations.

This guide explains JWTs from first principles: their structure, how signing works, when to use them, and how to use them safely.

What Is a JWT?

A JSON Web Token is a compact, URL-safe means of representing claims between two parties. It is defined by RFC 7519.

A JWT looks like this:

It has three parts separated by dots: Header . Payload . Signature

The Three Parts of a JWT

1. Header

The header is a Base64URL-encoded JSON object that declares the token type and signing algorithm:

{
  "alg": "HS256",
  "typ": "JWT"
}

Common algorithms: HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric), ES256 (ECDSA-SHA256, asymmetric).

2. Payload

The payload contains the claims — statements about the user or system, plus metadata. Standard registered claims include:

• sub — Subject (who the token is about, e.g. user ID)
• iss — Issuer (who created the token)
• aud — Audience (who the token is intended for)
• exp — Expiry time (Unix timestamp)
• iat — Issued-at time
• jti — JWT ID (unique identifier, useful for revocation)

{
  "sub": "user_abc123",
  "iss": "https://auth.example.com",
  "aud": "https://api.example.com",
  "exp": 1735689600,
  "iat": 1735686000,
  "name": "Jane Smith",
  "role": "admin"
}

3. Signature

The signature verifies that the token hasn't been tampered with. It is computed as:

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret
)

For HS256, the same secret is used to both sign and verify. For RS256, a private key signs the token and the corresponding public key verifies it — this is generally more secure for distributed systems.

How JWT Authentication Works (Step by Step)

1. Login: User sends credentials (username + password) to the auth server
2. Token issuance: Server validates credentials and returns a signed JWT
3. Client storage: Client stores the JWT (localStorage, sessionStorage, or an HttpOnly cookie)
4. API requests: Client sends the JWT in the Authorization header: Bearer <token>
5. Verification: Server validates the signature, checks expiry (exp), and reads claims
6. Response: If valid, server processes the request; if expired or invalid, returns 401

Signing Algorithms Compared

JWT Security Best Practices

• Use short expiry times. Access tokens should expire in 15–60 minutes. Use refresh tokens for longer sessions.
• Validate all claims. Always check exp, iss, and aud on every request — don't just check the signature.
• Use RS256 or ES256 over HS256 for services that verify but don't issue tokens.
• Reject the alg: none attack. Always specify and enforce the expected algorithm — never accept whatever the token header declares.
• Store tokens in HttpOnly cookies rather than localStorage to prevent XSS attacks from stealing tokens.
• Always use HTTPS. JWTs in transit over HTTP are trivially stolen.
• Implement a revocation strategy. JWTs can't be invalidated before expiry by default — use a token blacklist or short expiry + refresh token rotation.

JWT vs Session Tokens

Frequently Asked Questions

Related Guides

• What Is Base64 Encoding? A Complete Developer's Guide
• How to Use Bcrypt Generator: Practical Guide and Best Practices
• How to Use Cron Parser: Practical Guide and Best Practices