A JSON Web Token is a compact, signed value that carries claims between a client and a server.
A JWT is a compact token whose claims are encoded as JSON and whose signature lets a server detect tampering.
A JWT commonly contains a header, a payload, and a signature. The payload is readable by anyone who receives the token, so it should not be treated as secret storage.
Think of a JWT like a signed pass that carries its own visible details.
A guard can read the pass and check its signature before accepting it. The signature supports trust in the contents, while the guard still checks whether the pass is expired and valid for this door.
A JWT gives a server a portable way to carry identity or authorization claims across requests.
Represent facts such as a subject, issuer, audience, or expiration time.
Let the verifier reject a token whose signed contents were altered.
Allow a service to verify a token without looking up a session for every request.
Use expiration and audience claims to narrow when and where the token is accepted.
JWTs are used when services need a portable, verifiable representation of a login or delegated access decision.
An API validates a token sent with a protected request.
An app keeps an access token and presents it to a backend.
A service verifies the issuer, audience, and signature of an incoming token.
An identity provider issues claims that another service can verify.
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMyIsImV4cCI6MTg5MzQ1NjAwMH0.signature
The client sends the token in a request header. The API verifies the signature and checks claims such as expiration and audience before serving the request.
This token is illustrative. A JWT is encoded, not encrypted; use encryption or another protected channel when claims must remain confidential.
Authentication establishes who the caller is. Authorization decides what that caller may do. JWT validation is one part of that larger security flow.
A token format for carrying claims, often with a signature.
Server-managed state that associates a session identifier with stored data.
A method for keeping information unreadable without the right key; signing a JWT does not provide that confidentiality.
A valid signature does not automatically mean the request should be allowed. The server must still apply expiration, audience, scope, and permission rules.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| JWT | JSON Web Token | A compact token that carries claims and can be signed. | 一种小巧的令牌格式，可以携带声明并进行签名。 |
| Claim | 声明 | A piece of information carried inside a token. | 令牌中携带的一条信息。 |
| Header | 头部 | The part that describes the token type and signing algorithm. | 说明令牌类型和签名算法的部分。 |
| Payload | 载荷 | The part that contains the token claims. | 包含令牌声明的部分。 |
| Signature | 签名 | A value used to verify that signed token data was not changed. | 用来验证令牌内容是否被改动的一段值。 |
| Issuer | 签发者 | The system that issued the token. | 签发这个令牌的系统。 |
| Audience | 受众 | The service or party for which the token is intended. | 这个令牌准备交给哪个服务或对象使用。 |
| Expiration | 过期时间 | The time after which the token should no longer be accepted. | 超过这个时间后令牌不应再被接受。 |
| Bearer Token | 持有者令牌 | A token accepted from whoever presents it. | 谁拿着并提交它，系统就可能把它视为凭证的令牌。 |
A JWT is a signed, portable container for claims.
It can help a server verify token contents across requests, but it does not replace authorization checks or secure secret handling.
Core Flow:
Issue JWT → Send JWT → Verify signature and claims → Apply permissions