JWT Explained: What's Actually Inside a JSON Web Token

<p>If you've ever worked with auth, you've seen a JWT — a long string like <code>eyJhbGci...</code> split into three parts by dots. It looks cryptic, but it's surprisingly simple

<p>JWT (JSON Web Tokens) have become a default choice for authentication and authorisation in modern systems.</p> <p>They are widely adopted because they are:</p> <ul>

<p>JWTs are designed to be readable by the client. That is useful for debugging, but it also means a real token can contain user IDs, email addresses, roles, scopes and expiry

<p>Every developer pastes a <code>data:image/png;base64,iVBORw0K...</code> blob into their CSS at some point, decodes a JWT to see what's inside, or hits a "Basic " auth header

<blockquote> <p><em>JWT tutorials only teach the easy part. Here's what happens after.</em></p> </blockquote> <p>Most auth tutorials end at "user logs in, gets a token, done." And

<p>You click "Sign in with Google" on some app you've never used before. A popup flashes, you pick your account, and three seconds later the app knows your name and email. You

JSON Web Tokens (JWTs) are a cornerstone of modern web authentication, offering a compact and secure way to transmit information between parties.