Understanding JSON Web Tokens (JWT): Structure, Security, and Debugging Guide

JSON Web Tokens (JWT) are the open standard (RFC 7519) for securely transmitting information between client and server as a JSON object. JWTs power modern authentication systems in single-page applications (SPAs), mobile apps, and microservice architectures.

In this guide, we will unpack the internal architecture of a JWT token, highlight security vulnerabilities like algorithmic confusion, and show you how to inspect and verify tokens safely.

---

Anatomy of a JWT Token

A JWT string consists of three parts separated by dots (.):

header.payload.signature

1. Header

The header contains metadata about the token, including the signature algorithm (e.g., HS256 or RS256) and token type (JWT):

{
  "alg": "HS256",
  "typ": "JWT"
}

2. Payload (Claims)

The payload contains the statement claims about the user or session. Standard claims include:

• sub (Subject / User ID)
• iat (Issued At timestamp)
• exp (Expiration timestamp)
• role (User authorization level)

{
  "sub": "usr_948201",
  "name": "Jane Developer",
  "role": "admin",
  "exp": 1788180000
}

3. Signature

The signature is generated by taking the encoded header, encoded payload, a secret key (or private key), and hashing them using the specified algorithm. It verifies that the token sender is who it claims to be and that the message wasn't tampered with along the way.

---

Critical JWT Security Vulnerabilities & Best Practices

1. Beware of the "alg": "none" Exploit: Early JWT implementations mistakenly allowed tokens specifying "alg": "none" to bypass signature checks. Always explicitly enforce allowed algorithms on your backend.
2. Never Store Secrets in the Payload: JWT payloads are Base64URL encoded—NOT encrypted! Anyone with access to the token string can read user IDs, emails, or roles. Keep sensitive data (like database passwords or credit card info) out of JWT payloads.
3. Use Short Expiration Times (exp): Set access token lifespans to 15-60 minutes and implement refresh token rotation to minimize damage if a token is stolen.

---

Decode and Inspect JWT Tokens Instantly

Use our online JWT Decoder & Encoder to inspect payload claims, check token expiration dates in human-readable time, or generate mock tokens for your API integration tests safely.