---
title: "JWT"
description: "JWT is a signed JSON token that carries authentication data between server and client. Learn its structure, benefits and rules for using it securely."
url: "https://nodea.io/en/glossary/jwt"
lang: "en"
updated: "2026-07-13"
---

# JWT

> JWT (JSON Web Token) is a compact, digitally signed token in JSON format that carries information about a user, enabling stateless authentication in applications and APIs.

**JWT** (JSON Web Token) is an open standard (RFC 7519) that defines a compact, self-contained way to securely transmit information between parties as a [JSON](https://nodea.io/en/glossary/json) object. The token is digitally signed, so the recipient can verify that the data hasn't been altered and comes from a trusted issuer. JWT is now a foundation of stateless authentication in web applications and [APIs](https://nodea.io/en/glossary/api).

## How a JWT is structured

A token consists of three parts separated by dots, each Base64URL-encoded:

- **header** — states the token type and signing algorithm, e.g. HS256 or RS256;
- **payload** — carries the claims: a user identifier, roles, an expiry time (*exp*), the issuer (*iss*);
- **signature** — produced by hashing the header and payload with a secret or private key; this is what guarantees integrity.

When the server receives a token, it recomputes the signature with its own key and compares it to the one in the token. A match means the payload is authentic — with no need to query a database for a session.

## Practical application

The most common scenario is login: after successful authentication the server issues a JWT, which the client attaches to subsequent requests in an *Authorization: Bearer* header. The server validates the token on every request without keeping session state, which simplifies horizontal scaling and microservice architectures. JWTs also serve as access tokens and ID tokens in [OAuth 2.0](https://nodea.io/en/glossary/oauth) and OpenID Connect flows.

Using them safely takes discipline: short token lifetimes, enforcing a strong algorithm (rejecting *alg: none*), transmitting only over HTTPS and a well-designed refresh and revocation mechanism. Because the payload is merely encoded rather than encrypted, you never place [passwords](https://nodea.io/en/glossary/password) or other sensitive data inside it.

### Is the data inside a JWT encrypted?

Not in its standard form. A JWT's payload is only Base64URL-encoded, so anyone can read it. The token is signed, which lets you detect tampering, but sensitive data should never be placed in a plain JWT without additional encryption (JWE).

### How does a JWT differ from a classic session?

A session keeps state on the server while the browser holds only an identifier in a cookie. A JWT is stateless — the token itself carries all the needed data, so the server doesn't have to keep sessions in memory. This eases scaling but makes instant revocation harder.

## Related

- [OAuth](https://nodea.io/en/glossary/oauth)
- [JSON](https://nodea.io/en/glossary/json)
- [API](https://nodea.io/en/glossary/api)
- [REST](https://nodea.io/en/glossary/rest)
- [Password](https://nodea.io/en/glossary/password)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/jwt.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)