How JWT Tokens Work

JWT (JSON Web Token) is a standard for transmitting information securely between parties as a JSON object. It's widely used for authentication in web applications and APIs — once a user logs in, the server issues a JWT that the client includes in subsequent requests to prove identity.

The Structure: Three Parts

A JWT looks like this: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwibmFtZSI6IkFoaWxsYW4iLCJleHAiOjE3NTYzNDQ0MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Split by periods (.): HEADER.PAYLOAD.SIGNATURE

Part 1: Header

Base64-decoded, the header is JSON specifying the token type and signature algorithm: ``json {"alg": "HS256", "typ": "JWT"} ``

Part 2: Payload

Base64-decoded, the payload contains the claims — information about the user: ``json { "sub": "user123", "name": "Ahillan", "exp": 1756344400 } ``

Common claims:

• sub: subject (usually a user ID)
• exp: expiration timestamp (Unix time)
• iat: issued-at timestamp
• iss: issuer (the service that created the token)

Part 3: Signature

The signature is created by combining the header, payload and a secret key, then hashing with the specified algorithm. This proves the token hasn't been tampered with.

`` HMACSHA256(base64(header) + "." + base64(payload), secret_key) ``

How JWT Authentication Works

1. User logs in with username and password.
2. Server verifies credentials and issues a JWT signed with its secret key.
3. Client stores the JWT (usually in memory or localStorage).
4. For protected requests, client sends the JWT in the Authorization header: Authorization: Bearer <token>.
5. Server validates the signature and checks the expiry.

Debugging JWTs

When an API call returns 401 Unauthorized:

• Is the token expired? Check the exp claim.
• Is the token being sent correctly? Verify the Authorization: Bearer format.
• Is the payload correct? Decode and inspect the claims.

Use JWT Decoder to decode any JWT and read its header, payload and signature details without a secret key. For hashing concepts that underlie JWT signatures, see what is a hash: MD5, SHA-1 and SHA-256 explained.

JWTs in Laravel and PHP APIs

In Laravel, the tymon/jwt-auth package or Sanctum/Passport can issue JWTs for API authentication. The middleware verifies the token on each protected route — checking the signature and expiry without a database lookup, which is the performance advantage of stateless JWTs. If you need to revoke tokens before expiry (logout, account suspension), a blocklist table or short expiry combined with refresh tokens is the standard pattern. JWT Decoder lets you inspect any token's payload directly in the browser — useful when debugging authentication between Laravel and a React or Flutter frontend.