Security

JWT Authentication Explained: Header, Payload, and Signature

2026-07-12 · 5 min read

JSON Web Tokens (JWTs) have become the default way to pass authentication and authorization data between services. If you work with APIs, you have seen them — long strings of base64 separated by dots. But what is actually inside?

The Three Parts

A JWT has three parts separated by dots: header.payload.signature.

Header — A JSON object that says what type of token this is and which algorithm signed it. Usually {"alg":"HS256","typ":"JWT"}.

Payload — The data you want to carry. Standard claims include sub (subject/user ID), iat (issued at), exp (expiration), and iss (issuer). You can add custom claims too, but keep it small — every byte travels with every request.

Signature — A hash of the header and payload, signed with a secret key (HMAC) or a private key (RSA/ECDSA). This is what prevents tampering.

How Verification Works

When a server receives a JWT, it does not need to look up a database. It takes the header and payload, hashes them with the same secret, and compares the result to the signature. If they match, the token is valid. This is why JWTs are called self-contained.

Common Mistakes

Putting secrets in the payload — The payload is only base64-encoded, not encrypted. Anyone can decode it. Never put passwords, credit card numbers, or sensitive PII in a JWT.
Not checking expiration — Always verify the exp claim. A token without expiration is a permanent backdoor.
Using "none" algorithm — Some libraries accept alg: none, which means no signature at all. Disable this explicitly.
Too-large payloads — JWTs are sent in every HTTP header. A 5 KB token adds 5 KB to every request. Keep claims minimal.

JWT vs Session Cookies

Sessions store state on the server; JWTs store state in the token itself. Sessions are easier to revoke (delete the server record). JWTs are easier to scale (no shared session store). Most modern APIs use JWTs for stateless auth and short-lived tokens (15 minutes) with refresh tokens for longer sessions.

Try It Yourself

Paste any JWT into the JWT Decoder to see the header and payload decoded instantly. No verification — just inspection. Useful for debugging tokens during development.