No, by default. The payload is only Base64url-encoded and can be read by anyone. Signing protects integrity, not privacy.

Can I put a password in a JWT?

No. Anyone can decode the payload, so include only non-sensitive claims like a user ID and expiry.

What are the three parts of a JWT?

Header, payload and signature — each Base64url-encoded and joined by dots.

What Is a JWT (JSON Web Token)?

Published 9/5/2025 · 2 min read · Developer tools

Daniel Okonkwo — Front-end developer and tech writer at Allin

Web performance · File formats

Checked against 2 sources

View profile →

In short

A JSON Web Token (JWT) is a compact, signed token that carries information between parties as three Base64url parts separated by dots: header.payload.signature. The payload holds 'claims' like a user ID and expiry; the signature proves the token wasn't tampered with. It's readable by anyone, so never put secrets in it — the signature protects integrity, not confidentiality.

A JWT is a compact, signed token used to carry identity between services. Here's its three parts, how it's used for auth, and its security limits.

What a JWT is

A JWT is a self-contained token that a server can hand to a client to prove who they are, without keeping a session on the server. It looks like a long string of three chunks separated by dots. Because it carries its own signed claims, any service that trusts the signing key can verify it on its own — which is what makes it popular for stateless authentication across APIs.

The three parts

Split on the dots, a JWT has a header, a payload and a signature, each Base64url-encoded. The header names the signing algorithm and token type. The payload holds the claims — standard ones like sub (subject), exp (expiry) and iat (issued-at), plus any custom fields. The signature is computed over the header and payload with a secret or private key, so tampering with either part breaks it.

How it's used

In a typical flow, you log in, the server signs a JWT with your identity and an expiry, and sends it back. Your app then attaches it to each request, usually in the Authorization header as a 'Bearer' token. The server re-checks the signature and expiry on every request instead of looking up a session, which scales well across multiple services that share the key.

Security notes

A JWT is signed, not encrypted, so anyone holding it can decode and read the payload — never store passwords or sensitive data there. Always verify the signature server-side and reject expired tokens; a token you don't verify is worthless as proof. Keep expiry times short and, because a valid token grants access until it expires, store it carefully and have a way to revoke or rotate keys.

JWT decoderDecode a JWT, read its claims and dates, and check its HMAC signature.Try the tool →

Frequently asked questions

Is a JWT encrypted?: No, by default. The payload is only Base64url-encoded and can be read by anyone. Signing protects integrity, not privacy.
Can I put a password in a JWT?: No. Anyone can decode the payload, so include only non-sensitive claims like a user ID and expiry.
What are the three parts of a JWT?: Header, payload and signature — each Base64url-encoded and joined by dots.

Articles you may find interesting

All guides →

ExplainerWhat Is a Hash Function? (MD5, SHA-256)A hash function turns any input into a fixed-size fingerprint. Here's what it does, its key properties, common uses, and which algorithms are safe.ExplainerWhat Is a UUID (and When to Use It)?A UUID is a 128-bit identifier that's unique without any central authority. Here's what it looks like, why it's useful, the versions, and when to use one.ExplainerWhat Is a Cron Expression?A cron expression schedules a task to run automatically at set times. Here's what it's for, its five fields, how to read one, and the common gotchas.ExplainerWhat Is Base64 Encoding?Base64 turns binary data into safe text. Here's what it does, why it exists, why it isn't encryption, and the size cost it adds.ExplainerWhat Is Inside a JWT — and What It Does Not ProtectA JWT is signed, not encrypted. Anyone holding the token can decode the payload and read every claim in it. Here is a real token, decoded without any key, plus the three attacks the signature is supposed to stop and the one problem it cannot solve.How-toHow to Create a Strong PasswordLength beats complexity. Here's why a four-word passphrase is strong, why you should never reuse a password, and how a manager makes it effortless.

Sources

Spotted a mistake in this article?