JWT Explained: Structure, How It Works, and Common Misconceptions

A JWT (JSON Web Token) is a self-contained token format: three Base64Url segments joined by dots. Anyone can decode it, but only the key holder can forge one. This post dissects its structure and clears up the most frequent misconceptions. Grab a real JWT and follow along in our decoder tool.

The Three Segments

eyJhbGci...  .  eyJzdWI...  .  dBjftJeZ...
   Header         Payload        Signature

• Header: algorithm and type, e.g. {"alg":"HS256","typ":"JWT"}.
• Payload: the claims. The standard claims are listed below; anything else is a custom application field.
• Signature: a signature over the first two segments: HMACSHA256(base64(header) + "." + base64(payload), secret).

Standard Claims

Claim	Meaning	Example
iss	Issuer	"https://auth.example.com"
sub	Subject (usually the user ID)	"1234567890"
aud	Audience	"web"
exp	Expiration time (Unix seconds)	1900000000
nbf	Not valid before	1700000000
iat	Issued at	1700000000
jti	Unique token ID (replay protection)	"abc123"

The Three Most Common Misconceptions

Myth 1: Decoding = verifying. Base64Url is just an encoding — anyone can decode the payload and read its contents, so never put secrets like passwords in a JWT. Verifying the signature requires holding the key.

Myth 2: JWTs can be revoked on demand. Stateless means the server doesn't store tokens by default; once issued, a token stays valid until exp. To revoke, you need a blacklist, or short-lived tokens plus refresh tokens.

Myth 3: alg=none is harmless. The infamous 2015 alg=none attack: change the algorithm to none, strip the signature, and lenient libraries let the token straight through. Servers must enforce an algorithm allowlist and never read the algorithm from the token itself.

Checklist for "Why Did My Login Session Randomly Die?"

1. Decode the token and check whether exp has passed (the tool converts it to your local time automatically);
2. Check iat to see whether the server issued a new token while the frontend is still using the old one;
3. Make sure the server clock hasn't drifted (both exp and nbf depend on it).

Last updated: 2026-08-28