All Concept Bites
14 views
Securityintermediate

What is a JWT?

A signed, self-contained token that carries claims the server can verify

Reviewed by Abhijith N M · 24 October 2026 · Editorial standards

The Simple VersionNo jargon

A JWT is a compact string with three parts: a header, a payload of claims, and a signature. The server signs it with a secret or private key. Anyone can read the payload; the signature only proves it was issued by the holder of the key and was not altered. The server verifies the signature and checks claims such as expiry and audience. There is no central session lookup, which is the point. It also means a token stays valid until it expires unless you add a revocation list.

What is a JWT? — Visual Breakdown

#1
Header
Algorithm & token type
→
#2
Payload
Claims: user ID, role, expiry
→
#3
Signature
HMAC-SHA256(base64(header) + '.' + base64(payload), SECRET_KEY)
→
LAYER 1

Header

Algorithm & token type

Payload / Concrete Example
{ "alg": "HS256", "typ": "JWT" }
Why It Matters in Production
JWTs fit stateless APIs and service-to-service identity, but they are a poor default for browser sessions. Storing them in localStorage exposes them to any XSS; an httpOnly, Secure, SameSite cookie is safer. Keep access tokens short-lived and use refresh tokens with rotation. Always verify the algorithm, issuer, audience and expiry; never trust the header's alg field blindly. Do not put secrets or large profiles in the payload. If you need instant logout and fine-grained revocation, a server-side session is simpler and safer.
Implementation & Syntax
🐍Python
import jwt, datetime

SECRET = "your-secret-key"

# Create a token
payload = {
    "sub": "user_123",
    "role": "author",
    "exp": datetime.datetime.utcnow() + datetime.timedelta(hours=1),
}
token = jwt.encode(payload, SECRET, algorithm="HS256")

# Verify it later
decoded = jwt.decode(token, SECRET, algorithms=["HS256"])
print(decoded["role"])  # "author"

Quick Concept Check

Test your understanding in 15 seconds

Where should you store JWTs to protect against XSS?

Related Concepts

Complementary topics
What is OAuth?
What is HTTPS?
Level Up

Want hands-on practice building this end-to-end?

Check out the full structured learning path with guided projects and code evaluations.

Explore Course

Written and edited by the nexGenCoders team. Spotted a mistake? Tell us and we will fix it.