After logging in, how does the server know it's you? Modern web applications commonly use JWT to transmit identity information. Understanding the structure and principles of JWT is crucial for developing and debugging authentication systems. This tutorial explains JWT in a straightforward way.
What is JWT?
JWT stands for JSON Web Token, a compact token format used for securely transmitting information between parties. Its most common use case is authentication: after a user logs in, the server issues a JWT, which the client then includes with every request to prove its identity.
Three-Part Structure
A JWT consists of three parts, separated by dots: Header, Payload, and Signature, appearing as xxxxx.yyyyy.zzzzz.
The Header describes the token type and signing algorithm; the Payload holds claims, such as user ID, issued at (iat), and expiration time (exp); the Signature uses a key to sign the first two parts to prevent tampering.
Payload is Not Encrypted
A common misconception: the Header and Payload are only Base64Url-encoded, not encrypted. Anyone with the JWT can decode it to see the contents of the Payload.
Therefore, never store sensitive information like passwords or bank card numbers in the Payload. The signature only ensures that the content hasn't been tampered with, not that it's confidential.
How the Signature Prevents Tampering
The signature is computed using a key held by the server on the Header and Payload. If someone alters the Payload (for example, changing the user ID to someone else's), the recalculated signature won't match, and the server will invalidate the token accordingly.
Because verifying the signature requires a key, pure client-side tools can only "decode and view" but not "verify the signature," which is a normal and secure design.
Practical Methods for Debugging JWT
During debugging, it's often necessary to see what's inside a JWT. Use qktools' JWT parser tool to paste the token and decode the Header and Payload locally, automatically converting the expiration time to a readable format and indicating whether it's expired. The token is not uploaded.
To further understand the Base64Url encoding involved, you can read our article on Base64 or try it out with the Base64 encoding and decoding tool.