IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
What is a JWT? Your first token
Maya logs in once. Then every page knows it is her, without asking for her password again. The trick is a token: a small pass the app carries instead of her password. Your goal: read a JWT by eye.
- A token is a small pass the app shows instead of a password.
- A JWT has three parts joined by dots: header.payload.signature.
- The payload holds claims: who, from whom, for whom, until when.
- Anyone can read a JWT. Only the signature proves it is real.
Why a token?
The web forgets you between requests, so something must say "still me" each time. A cookie is one way to carry that proof. A JWT is a common kind of proof in modern apps. After you sign in, the server makes this token and gives it to your browser or app. The app shows it on every request. It is like showing a wristband instead of buying a new ticket at every door.
Three parts, two dots
A JWT (say "jot") is three chunks of Base64 joined by dots. The web-safe kind is called Base64url. The shape is header.payload.signature.
- The header says the kind of token and how it is sealed.
- The payload holds the claims. Claims are the facts.
- The signature is the wax seal from the last lesson. It proves the token is real and unchanged.
Reading the claims
A few short, standard claims answer simple questions.
| Claim | Short for | In plain words |
|---|---|---|
sub | subject | Who is this token about? (your user id) |
iss | issuer | Who made it? (the login server) |
aud | audience | Who is it for? (which app or API) |
exp | expiry | Until when does it work? (after that it is dead) |
a train ticket. It prints your name (sub). It names who issued it (iss) and your train (aud). It shows the date it is valid until (exp). Anyone can read it. The stamp is the signature: hard to fake and quick to check.
1. Base64 is not secrecy. The payload only looks scrambled. Anyone holding the token can decode it in one step (the encoding lesson again). So never put a secret, like a password or card number, inside a JWT.
2. Reading is not trusting. Anyone can read a token. Only checking the signature proves it is real and unchanged. The full list of checks is in validating a JWT. The whole family of tokens is in the tokens lesson.
🧪 Interactive lab — enable JavaScript to play with this one.
Paste a real JWT and check each claim with ID Token Check. Then see the public keys that check its seal with JWKS Check.