JWT Nedir? JSON Web Tokens'in Tam Açıklaması
Quick Answer
JWT, noktalarla ayrılmış üç Base64URL kodlanmış parçaya sahip bir dizgidir: header.payload.signature. Header algoritmayı belirtir, payload claim'leri (user ID, roles, expiration) içerir ve signature authenticity kanıtlar. Token içeriğini incelemek için ücretsiz JWT Decoder kullanın.
Introduction
JWT (JSON Web Token), RFC 7519 tarafından tanımlanan, taraflar arasında JSON object olarak güvenli bilgi iletmek için kompakt, URL-safe token formatıdır. JWT'ler web uygulamalarında authentication için yaygın olarak kullanılır: login sonrası sunucu bir JWT verir ve client bunu sonraki request'lere dahil eder. JWT'ler stateless'tir —sunucu token'ı veritabanında lookup yapmak zorunda değildir; token kendisi claim'leri ve signature içerir.
Step by Step
-
Understand the three-part structure
A JWT has three parts: header (algorithm and type), payload (claims), and signature (proves integrity). Each part is Base64URL-encoded and separated by dots: eyJhbGciOi...J9.eyJzdWIi...J9.signature. The first two parts are readable by anyone with the token; only the signature requires the secret key.
-
Learn the standard claims
The payload contains claims — statements about the subject. Standard claims: 'sub' (subject/user ID), 'iat' (issued at timestamp), 'exp' (expiration), 'nbf' (not before), 'iss' (issuer), 'aud' (audience). Custom claims can include roles, permissions, or any other data.
-
Understand signing algorithms
JWTs use symmetric (HS256 — shared secret) or asymmetric (RS256, ES256 — public/private key pair) signing. The signature prevents tampering: changing any part of the token invalidates the signature. Only the holder of the secret/private key can create valid tokens.
-
Use JWTs for authentication
After login, the server creates a JWT and sends it to the client. The client includes the JWT in the Authorization header (Bearer token) for subsequent requests. The server verifies the signature and checks expiration — no database lookup needed.
Examples
JWT structure
Input: A typical JWT
Output: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMSIsImV4cCI6MTY5MzYxMjgwMH0.signature
Decoded header
Input: First part decoded
Output: {"alg": "HS256", "typ": "JWT"}
Decoded payload
Input: Second part decoded
Output: {"sub": "user1", "name": "Alice", "iat": 1693526400, "exp": 1693612800}
Common Problems
- Decoding vs verifying —decoding a JWT (reading its contents) does NOT prove it is authentic. Always verify the signature server-side with the secret key before trusting claims.
- Storing JWTs in localStorage —this makes them accessible to JavaScript, vulnerable to XSS attacks. Store in httpOnly cookies for better security.
- Long-lived tokens —if a token is stolen, it remains valid until expiration. Use short-lived access tokens (15-60 min) with refresh tokens for long sessions.
- Sensitive data in payload —the payload is readable by anyone with the token (it is Base64, not encrypted). Never put passwords, credit cards, or secrets in the payload.
Tips
- Always verify the JWT signature server-side before trusting any claims —decoding alone is not authentication.
- Use short-lived access tokens (15-60 minutes) with refresh tokens for long sessions to minimize damage from token theft.
- Store JWTs in httpOnly, Secure, SameSite cookies rather than localStorage to prevent XSS attacks.
- Use our JWT Decoder to inspect token contents for debugging —your token never leaves your browser.