What is a JWT?#
A JWT is a short "digital ID card". When you log in to an app with a username and password, the server gives you a long string. From then on, the app sends this string with every request (usually in the Authorization header), and the server checks its signature to know who you are.
What is it made of?#
A JWT has three parts separated by dots:
- Header: the token type and the signing algorithm
- Payload: data such as the user ID, their role and the expiry time
- Signature: a guarantee that the content has not been tampered with
An example#
Imagine a shop's mobile app. After login, the app stores the token and sends it to the API to show your orders. The server does not need to look up a session in the database; it only checks the signature and the expiry date. This is why JWTs are popular for APIs and microservices.
Common mistakes#
- It is not encryption: the payload is only Base64-encoded and anyone can read it. Never put passwords or sensitive data in it.
- Revoking is hard: an issued token stays valid until it expires, so keep its lifetime short and use refresh tokens.
- Storage matters: keeping the token where scripts can reach it makes it vulnerable to XSS attacks.