Edit: What is JWT? From Concept to Structure …

Posts›What is JWT? From Concept to Structure …

PublishedView Live →

Title

Slug

Preview: https://jwtsecretgenerator.com/blog/what-is-jwt

⚠ Changing the slug will break existing links to this post.

Description / Excerpt

100 / 180 characters

Content (Markdown)

# What is JWT? From Concept to Structure Explained

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. Defined in RFC 7519, JWTs are the backbone of modern stateless authentication.

## The Three-Part Structure

A JWT consists of three Base64URL-encoded parts separated by dots:

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkpvaG4iLCJpYXQiOjE1MTYyMzkwMjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
      HEADER                                    PAYLOAD                                                SIGNATURE
```

### Header

```json
{
  "alg": "HS256",
  "typ": "JWT"
}
```

Specifies the signing algorithm and token type.

### Payload (Claims)

```json
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622
}
```

Contains the claims — statements about the user and metadata. Standard claims include:

| Claim | Name | Description |
|-------|------|-------------|
| `iss` | Issuer | Who created the token |
| `sub` | Subject | Who the token refers to |
| `aud` | Audience | Who the token is intended for |
| `exp` | Expiration | When the token expires (Unix timestamp) |
| `iat` | Issued At | When the token was created |
| `jti` | JWT ID | Unique identifier for the token |

### Signature

```
HMAC-SHA256(
  base64url(header) + "." + base64url(payload),
  secret
)
```

The signature ensures the token hasn't been tampered with. Only someone with the secret key can produce a valid signature.

## How JWT Authentication Works

1. User logs in with credentials
2. Server validates credentials, creates a JWT signed with its secret
3. Server returns the JWT to the client
4. Client includes the JWT in subsequent requests: `Authorization: Bearer <token>`
5. Server validates the signature and extracts claims — no database lookup needed

This stateless design is why JWTs scale so well in distributed systems.

281 words · ~2 min readMarkdown guide →

Tags (0/8)

Author Name

Status

Cover Image URL (optional)

Danger Zone

Deleting this post sets its status to "deleted". It can be recovered via the API.