// decode header · inspect payload claims · check expiry · verify signature · nothing leaves your browser
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims like user ID, roles, expiry), and a signature to verify the token hasn't been tampered with.
exp, iat, nbf are shown with human-readable timesJSON Web Tokens are the foundation of modern stateless authentication. When a user logs in, the server creates a JWT containing the user's identity and permissions, signs it with a secret key, and sends it to the client. The client stores this token (typically in localStorage or a cookie) and sends it with every subsequent request in the Authorization header.
The server can then verify the token's signature without consulting a database — it simply recomputes the signature using its secret key and checks it matches. This makes JWT-based auth highly scalable since there's no session store to query on every request. The token itself carries all the information needed to authenticate the user.
The three-part structure of a JWT (header.payload.signature) means the header and payload are readable by anyone — they're just Base64URL encoded, not encrypted. Only the signature requires the secret key to verify. Never store sensitive data like passwords in a JWT payload unless the token is encrypted (JWE).
sub (Subject) — Identifies the principal that is the subject of the JWT. Usually the user ID.
iss (Issuer) — Identifies the principal that issued the JWT — typically your auth server's URL.
aud (Audience) — Identifies the recipients the JWT is intended for. Your API should reject tokens not intended for it.
exp (Expiration) — Unix timestamp after which the token must not be accepted. Always set an expiry on JWTs.
iat (Issued At) — Unix timestamp when the JWT was issued. Useful for determining token age.
nbf (Not Before) — Unix timestamp before which the token must not be accepted.
sub (subject) — who the token refers to. iss (issuer) — who created it. aud (audience) — who it's intended for. exp (expiry) — when it expires. iat (issued at) — when it was created. nbf (not before) — earliest valid time.exp claim is a Unix timestamp. When the current time passes that timestamp, the token is considered expired and should be rejected by your server. Most auth systems issue short-lived tokens (15 min to 1 hour) and use refresh tokens to get new ones.