JSON Web Token is a signed, compact token format that lets software systems share verified identity and permission claims. Often called a JWT, it is commonly used for API authentication and authorization. Its readable contents are not automatically secret, so sensitive data should not be placed in the token.
JSON Web Token
What Is a JWT Token?
A JSON Web Token, or JWT, is a compact signed credential that lets software share verified identity and permission claims. It is commonly used to authenticate API requests and decide what a user may access.
How JSON Web Tokens Work
JWT authentication typically follows this flow.
- A user signs in and the server checks their credentials.
- The server issues a signed token with an expiry and intended audience.
- The app sends it with later API requests.
- The API verifies the signature, issuer, audience, and expiry.
- The API authorizes the requested action from valid claims.
JWT Structure: Header, Payload, and Signature
A JWT has three Base64Url-encoded, dot-separated parts: header, payload, and signature. The payload can include subject, issuer, audience, and expiry claims. Decoding a JWT only makes its contents readable. It does not prove the token is valid or trustworthy.
Signed JWTs vs Encrypted Tokens
Base64Url encoding is not encryption.
| Type | What it protects | Typical use |
|---|---|---|
| Signed JWT | Integrity | API access tokens |
| Encrypted JWT | Integrity and confidentiality | Sensitive token claims |
Benefits of JWT Authentication
JWTs work well across APIs and services.
- Compact credentials for HTTP requests.
- Standards-based claims that multiple services can verify.
- No central session lookup is required for each request.
Practical Limits and Security Risks
A signed token is secure only when applications validate it correctly.
- Stolen tokens can be used until they expire.
- Use short expirations, key rotation, and strict issuer and audience checks.
- Do not put secrets or frequently changing permissions in payloads.
Using JWTs in Applications Built with Emergent
Emergent can help build full-stack apps with login flows, protected APIs, and authorization checks. When planning an AI-built website or a web application, specify who can access each feature and how tokens must be validated.
Frequently Asked Questions
Your Questions, Answered
This will automatically populate, don't change
Don't change this element unless you know what you are doing
How do you generate a JSON Web Token?
After successful authentication, a trusted server creates claims, sets a short expiry, and signs the token with an approved key and algorithm.
How do you decode a JWT safely?
A JWT decoder can read its header and payload, but treat decoded data as untrusted until your server verifies its signature and claims.
Are JSON Web Tokens encrypted?
Usually, no. Most JWTs are signed, not encrypted. Their payload can be read by anyone holding the token.
What happens if someone steals a JWT token?
They may impersonate the holder until the token expires or is revoked. Use HTTPS, short lifetimes, secure storage, and token rotation where appropriate.
Do JSON Web Tokens expire?
They should. The exp claim sets the time after which a validator must reject the token.
What does an unauthorized nil JSON Web Token error mean?
It usually means the application expected a token but received none, an empty value, or an invalid token field. Check the Authorization header, cookie, and login flow.
Start Building
on Emergent today
on Emergent today
Start Building
