JWT (JSON Web Token)
A JWT, or JSON Web Token, is a compact string, made of three parts separated by dots, that carries a set of claims, such as a user ID or an expiry time, along with a signature proving it was issued by a trusted party. Services use it to pass identity or permission information without a database lookup on every request.
Why it matters
The claims inside a standard JWT are only encoded, not encrypted, which means anyone can decode and read them, they just cannot forge a valid signature without the signing key.
Can anyone read what's inside a JWT?
Yes, the payload is just base64-encoded, not encrypted, so treat its contents as visible to anyone who has the token.
How is a JWT different from an API key?
A JWT usually carries structured claims and an expiry built in, while an API key is typically an opaque string the service looks up in its own records.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.