Glossary · Security

JWT (JSON Web Token)

A JWT is a compact, signed token containing JSON claims about a user or session, widely used to carry identity and permissions between services.

Updated October 6, 2026

A JWT (JSON Web Token) is a compact string made of three Base64URL parts, header, payload and signature, that carries claims such as user ID and expiry. The signature lets a receiver check that the token was not altered.

Why it matters

JWTs let APIs verify a caller without a database lookup for every request, which suits distributed systems. But the payload is only encoded, not encrypted, so anyone holding the token can read it. Because they are hard to revoke before expiry, lifetimes should be short.

Example

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0MiIsImV4cCI6MTc2MDAwMDAwMH0.<signature>

Decoding the middle part gives {"sub":"42","exp":1760000000}. The server recomputes the signature to confirm it is genuine.

Common mistakes

  • Putting secrets or personal data in the payload, assuming it is hidden.
  • Accepting the alg none header or not pinning the expected algorithm.
  • Storing long-lived tokens in places that scripts can read, such as localStorage, which XSS can steal.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Guide · MonitoringHow to Monitor API Endpoints: Status, JSON Checks, Latency and CronSet up reliable API monitoring: choose endpoints, validate status and JSON fields, handle auth headers safely, track latency and watch scheduled jobs.8 min readError fix · Developer errorsMySQL ERROR 1366: Incorrect String Value for Column (utf8mb4 Fix)Fix MySQL ERROR 1366 Incorrect string value for emoji and 4-byte characters. Convert to utf8mb4, set the connection charset, and avoid index length traps.4 min readGlossary · SecurityCSR (Certificate Signing Request)A CSR is a signed message containing your public key and domain details that you send to a CA to request a TLS certificate.Glossary · SecurityHashingHashing converts input of any size into a fixed-length digest with a one-way function, so the same input always gives the same output but cannot be reversed.Glossary · SecurityKey Pair (Public and Private Key)A key pair is a mathematically linked public key and private key used for encryption, signatures and TLS authentication.Error fix · Developer errorsCORS Error: "No Access-Control-Allow-Origin header is present" FixFix the browser CORS error "No Access-Control-Allow-Origin header is present" with server header examples, preflight handling and credentials rules.4 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.