JWT
Debugger Hub

JSON Web Token (JWT) is a foundational open standard (RFC 7519) in 2026 for secure information exchange between parties as a compact, URL-safe JSON object. Unlike traditional session headers, a JWT is self-contained; it carries all the necessary information about a user, eliminating the need for constant database queries on every request. This information is Base64Url encoded, ensuring it can be transmitted safely within HTTP headers or URL parameters. Most importantly, a JWT is digitally signed using either a shared secret (HMAC algorithm) or a cryptographic public/private key pair (RSA or ECDSA). This signature guarantees the authenticity and integrity of the data, meaning any tampering with the token after it has been issued will immediately invalidate it.

A JWT consists of three distinct parts separated by dots (.): the Header, the Payload, and the Signature. The Header typically specifies the token type and the hashing algorithm being used, such as HS256 or RS512. The Payload is the "meat" of the token, containing the actual data known as "claims." These claims can be registered (standard fields like sub for user ID or exp for expiration), public, or private. Finally, the Signature is created by taking the encoded header, the encoded payload, and a secret key, then hashing them together. This ensures that the identity provider can verify that the sender of the JWT is who they say they are and that the message hasn't been changed along the way.