What is a JWT?

Question

What is a JWT?

Anubhav Sharma · Answer

A JWT (JSON Web Token) is a compact, URL-safe token format used to securely transmit information between parties as a JSON object. It's commonly used for authentication and authorization in web applications and APIs. Structure of a JWT A JWT has three parts, separated by dots (.): 1. Header Typically contains: 2. Payload (Claims) Contains data or claims about the user or subject: You can include custom claims too, but avoid putting sensitive data here—it's not encrypted by default. 3. Signature Used to verify that the token was not tampered with. Created like: Or with a private key if using asymmetric encryption (RS256, etc.). Common Uses of JWT Authentication: After login, the server generates a JWT and sends it to the client. The client stores and sends it with every request.Authorization: The server reads the JWT to determine what the user is allowed to do.Stateless APIs: No session storage required—everything is in the token. Important Notes JWTs are signed, not encrypted (unless using JWE). Anyone can read the payload if they have the token.Never put passwords or private info in a JWT unless encrypted.Use short expiration times and refresh tokens for better security. Read Also How to decode JWT Token Visual Studio 2022?How does token-based authentication work?Pros and Cons of API Key Authentication vs. OAuth and JWT

ICSM Computer · Answer

A JWT (JSON Web Token) is a compact, URL-safe token format used to securely transmit information between parties as a JSON object. It is widely used in authentication and authorization in modern web APIs. Structure of a JWT A JWT has three parts, separated by dots (.): Example: 1. Header Specifies the type of token and the signing algorithm. 2. Payload (Claims) Contains the actual data (claims) like user ID, name, expiration time, etc. Example: Common standard claims: iss – Issuersub – Subject (user ID)aud – Audienceexp – Expiration timeiat – Issued at The payload is not encrypted — it's just Base64 encoded, so never put sensitive data in it. 3. Signature Used to verify the token wasn't tampered with. It's created like this: The server can verify the JWT using the secret (or a public key, if using RSA). Why Use JWTs? Benefit Description Stateless No server-side session needed Compact Easily stored in headers, cookies, or localStorage Self-contained Contains all needed user claims Cross-domain support Easy for SPAs, mobile apps, and APIs Verifiable Tamper-proof due to signature Common Use Cases Authentication After login, the server issues a JWT.Client includes it in headers on each request: Authorization APIs decode the JWT and check roles/permissions in the payload. Information exchange Securely pass info between systems with assurance it's not altered. JWT Best Practices Use HTTPS to protect tokens in transit.Set short expiry (exp) times.Use strong secrets or keys.Don't store sensitive info (like passwords).Use refresh tokens to renew expired tokens.Revoke JWTs via blacklisting (since they are stateless).

Benefit	Description
Stateless	No server-side session needed
Compact	Easily stored in headers, cookies, or localStorage
Self-contained	Contains all needed user claims
Cross-domain support	Easy for SPAs, mobile apps, and APIs
Verifiable	Tamper-proof due to signature

interview

What is a JWT?

Can you answer this question?

2 Answers

Structure of a JWT

1. Header

2. Payload (Claims)

3. Signature

Common Uses of JWT

Important Notes

Structure of a JWT

1. Header

2. Payload (Claims)

3. Signature

Why Use JWTs?

Common Use Cases

JWT Best Practices