# JWT (JSON Web Token)

Canonical page: /glossary/jwt

API keys & secrets glossary, Keys & secrets. JWT: What's Inside One and Why It Matters

**Short answer:** A JWT, or JSON Web Token, is a compact string, made of three parts separated by dots, that carries a set of claims, such as a user ID or an expiry time, along with a signature proving it was issued by a trusted party. Services use it to pass identity or permission information without a database lookup on every request.

## Why it matters

The claims inside a standard JWT are only encoded, not encrypted, which means anyone can decode and read them, they just cannot forge a valid signature without the signing key.

## In Claude Keychain

Claude Keychain treats a JWT like any other secret string: stored once under a name, handed to a command as an environment variable when needed, and never decoded or inspected by Claude Keychain itself.

## Common questions

**Can anyone read what's inside a JWT?**

Yes, the payload is just base64-encoded, not encrypted, so treat its contents as visible to anyone who has the token.

**How is a JWT different from an API key?**

A JWT usually carries structured claims and an expiry built in, while an API key is typically an opaque string the service looks up in its own records.

## Related

[OAuth token](/glossary/oauth-token), [Webhook secret](/glossary/webhook-secret), [API key](/glossary/api-key)