Three parts, two dots

JWT Authentication Course · lesson 1 of 13 · 4 min read

A JWT is not encrypted. Anyone can read it - the signature only proves it was not altered.

Open this lesson in the learning hub

Key points

  • A JWT is header.payload.signature, each Base64URL encoded and joined by dots.
  • Base64 is encoding, not encryption. Anyone holding the token can read every claim.
  • So never put a password, a card number or anything secret in a JWT payload.
  • The signature proves the token was issued by someone holding the key and has not been modified since.
  • The header names the algorithm; the payload carries the claims; the signature covers both.

A JWT is readable by anyone - the signature protects integrity, never confidentiality.

Standard claims and what they are for

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the JWT Authentication Course course, and every lesson in it is listed on the JWT Authentication Course contents page.