What Is a JWT, and How Does It Keep You Logged In?
If you've ever opened your browser's developer tools and noticed a long, strange string of letters and numbers stored under "Local Storage" or sent along with a request header, there's a good chance you were looking at a JWT. It stands for JSON Web Token, and it's one of the quiet workhorses of the modern web — the thing that lets a site remember who you are without making you type your password on every single click.
The Problem It Solves
The web runs on HTTP, and HTTP is "stateless" by design — each request a browser makes to a server is treated independently, with no built-in memory of what happened before. That's a problem the moment you want to log in once and then browse multiple pages without re-entering your credentials every time.
Tokens solve this. After you log in successfully, the server hands your browser a piece of proof — a token — and your browser then includes that proof with every later request. The server checks the proof instead of asking you to log in again. A JWT is simply one common, standardized format for that proof.
What's Actually Inside One
A JWT isn't encrypted or hidden — it's just encoded, which is a different thing entirely. It's made of three parts separated by dots, like xxxxx.yyyyy.zzzzz:
- Header — says which algorithm was used to sign the token.
- Payload — the actual data, usually things like a user ID, an expiration time, or which account role you have. This is just Base64-encoded JSON, meaning anyone can decode and read it in seconds.
- Signature — a cryptographic stamp, created with a secret key only the server knows, that proves the payload hasn't been tampered with since the server issued it.
That last point is the key idea: a JWT isn't secret, it's tamper-proof. Anyone who intercepts one can read what's inside, but they can't quietly change the payload (say, swapping their user role from "customer" to "admin") without the signature breaking and the server rejecting the token.
Why Developers Like Them
JWTs became popular because the server doesn't need to keep a record of every active session in a database. All the information the server needs is packed into the token itself, and verifying the signature is fast — just math, no database lookup. That makes them a natural fit for APIs, mobile apps, and systems made up of several independent services that all need to recognize the same logged-in user.
The Trade-Off Worth Knowing
Because a JWT carries its own expiration time and the server doesn't track it in a database, there's usually no simple way to "revoke" one early — once it's issued, it stays valid until it expires on its own, even if you log out. That's why many sites pair a short-lived JWT (minutes to an hour) with a longer-lived refresh mechanism behind the scenes, so damage from a stolen token is limited to a small window.
It's also why you should never paste a JWT you don't fully trust into a random website, and why a token showing up somewhere it shouldn't (a public chat log, a screenshot, a URL you shared) is worth treating as compromised — because, again, anyone holding it can read everything encoded inside and use it as proof of identity until it expires.
Seeing One for Yourself
If you've copied a JWT from a browser request and want to see what's actually encoded in the payload — without pasting it into a tool that might log it somewhere — our JWT Decoder reads and displays the header and payload entirely in your browser, so the token never leaves your device.