What Is a JSON Web Token

A JSON Web Token (JWT) is an open standard for securely transferring data between two parties — most commonly between a user and a server. In essence, it is a long text string containing login data, which the server verifies without needing a database. Today JWT is present almost everywhere: in web application logins, in API connections and in authentication between microservices.

eyJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImpvaG4ifQ.KmF8vX7qz3

How the Token Is Built

The token consists of three parts, separated by dots. Each part is separately encoded in Base64 format:

1. header — tells which algorithm is used for the signature,
2. payload — the actual data, for example the username and role,
3. signature — the cryptographic signature the server uses to verify authenticity.

How Login Works

The process is simple: the user logs in with a password, the server verifies it and issues a token. The user sends this token back with every subsequent request — usually in the HTTP header. The server verifies the signature and knows the token was issued by itself, without looking anything up in the database.

// Server response upon successful login
{ "token": "eyJhbGciOiJIUzI1NiJ9..." }

// Subsequent user request
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...

Advantages of Stored Content

Because the data is written directly into the token, the server needs no sessions or database to know who the user is. This makes JWT an excellent fit for distributed systems, where multiple servers serve the same application — each verifies the signature independently.

Careful with the Content

It is important to know: the payload part is only encoded, not encrypted. Anyone holding the token can read its content — this can even be done in a browser. Therefore we never write passwords or sensitive data into it. Security relies on the signature, which prevents anyone from altering the content.

Token Lifetime

A token usually has a limited lifetime (e.g. 15 minutes or 1 hour), written directly into the payload. Once it expires, the user obtains a new one — often with a refresh token, which lives longer. This way, stealing a short-lived token gains the attacker relatively little.

Where JWT Is Used

The most common use is modern APIs, where token-based login is more practical than sessions: tokens can travel between domains and servers and require no stored state on the server. For classic PHP websites with sessions, however, JWT is not necessary — sessions work just fine there.

JWT in one sentence: a signed ticket with data written directly on it, which the server can verify without memory — but it always only verifies, never reveals.