--- title: "JSON Web Token — Identity Glossary | IDSync" description: "A JSON Web Token (JWT) is a compact, signed (and optionally encrypted) JSON payload used to transmit claims about a user or workload between parties — most…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "JSON Web Token", "item": "https://idsync.com/glossary/jwt" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/jwt", "name": "JSON Web Token", "alternateName": [ "JWT", "JWT", "Bearer Token" ], "description": "A JSON Web Token (JWT) is a compact, signed (and optionally encrypted) JSON payload used to transmit claims about a user or workload between parties — most commonly as an OAuth 2.0 access token or OpenID Connect ID token.", "url": "https://idsync.com/glossary/jwt", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. JSON Web Token Standards # JSON Web Token (JWT) A JSON Web Token (JWT) is a compact, signed (and optionally encrypted) JSON payload used to transmit claims about a user or workload between parties — most commonly as an OAuth 2.0 access token or OpenID Connect ID token. Last reviewed 3 months ago Key points - Structure: header.payload.signature, base64url-encoded, separated by dots. - Signed JWTs (JWS) prove the issuer and prevent tampering — they do NOT hide the payload. Anyone can decode it. - Common claims: iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued at), scope, roles. - Validate signature, issuer, audience, and expiry on every request. Never trust a JWT just because it parses. - JWTs are stateless — once issued, they're valid until expiry. Use short lifetimes (5–15 min) and refresh tokens for revocability. ## What is a JWT? A JSON Web Token (JWT, RFC 7519) is a compact way to package a set of **claims** as a JSON object and transmit them between parties with cryptographic integrity. It's the format behind most modern OAuth 2.0 access tokens, every OpenID Connect ID token, and a huge fraction of service-to-service authentication on the internet. A JWT looks like `eyJhbGciOi...header.eyJzdWIiOi...payload.MEUCIQ...signature` — three base64url-encoded segments joined by dots. ## How it works 1. An **issuer** (the authorization server / IdP) builds a JSON payload of claims and signs it with its private key (JWS) or encrypts it (JWE). 2. The token is handed to a client, which presents it as a Bearer token: `Authorization: Bearer eyJ...`. 3. The **resource server** (your API) fetches the issuer's public keys from its **JWKS endpoint**, verifies the signature, and checks the claims. Standard claims: - `iss` — who issued this token - `sub` — the subject (user or workload ID) - `aud` — who this token is intended for - `exp` — when it expires (Unix timestamp) - `iat` — when it was issued - `scope` / `scp` — OAuth scopes - Custom claims for roles, tenant, etc. ## When buyers care JWTs are everywhere in modern identity: every OIDC sign-in flow returns one, every OAuth-protected API consumes one, and almost every service mesh uses them for mTLS-bound workload identity. ## Common misconceptions - **"JWTs are encrypted."** Signed JWTs (JWS) are _not_ encrypted — anyone who intercepts one can decode the payload. Don't put secrets in JWT claims unless you're using JWE. - **"Just decode it to trust it."** A JWT you didn't verify is just JSON. **Always** validate the signature, issuer, audience, and expiry — and ideally use a vetted library. - **"JWTs solve session management."** They don't. Stateless tokens are hard to revoke. The standard pattern is short-lived access tokens + refresh tokens + a revocation store for the refresh tokens. - **"`alg: none` is fine."** It is not. RFC 8725 explicitly warns against accepting `alg: none` or letting the token dictate which algorithm verifies it. Pin the algorithm server-side. ## Editorial note If a vendor's API uses long-lived (multi-day) JWTs with no revocation story, treat that as a red flag. The right pattern is short-lived JWTs + refresh tokens + token introspection (RFC 7662) when revocability matters. ## Standards & references - [RFC 7519 — JSON Web Token](https://datatracker.ietf.org/doc/html/rfc7519) - [RFC 8725 — JWT Best Current Practices](https://datatracker.ietf.org/doc/html/rfc8725) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [authorization](/directory/category/authorization)[api security](/directory/category/api-security) ### Related terms [oauth 2](/glossary/oauth-2)[openid connect](/glossary/openid-connect)[access token](/glossary/access-token)[refresh token](/glossary/refresh-token) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the authorization category. [Explore tools](/directory/category/authorization) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.