JWT (JSON Web Token)

A JWT (JSON Web Token) is a compact string made of three Base64URL parts, header, payload and signature, that carries claims such as user ID and expiry. The signature lets a receiver check that the token was not altered.

Why it matters

JWTs let APIs verify a caller without a database lookup for every request, which suits distributed systems. But the payload is only encoded, not encrypted, so anyone holding the token can read it. Because they are hard to revoke before expiry, lifetimes should be short.

Example

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0MiIsImV4cCI6MTc2MDAwMDAwMH0.<signature>

Decoding the middle part gives {"sub":"42","exp":1760000000}. The server recomputes the signature to confirm it is genuine.

Common mistakes

• Putting secrets or personal data in the payload, assuming it is hidden.
• Accepting the alg none header or not pinning the expected algorithm.
• Storing long-lived tokens in places that scripts can read, such as localStorage, which XSS can steal.

Related

• OAuth
• XSS
• Digital signature
• Session hijacking
• टूल: JWT decoder

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.