No, not by default. A standard JSON Web Token is signed but not encrypted, which means that its contents can be read by anyone who holds it. The signature protects the token from being altered, but it does not hide the data. Sensitive information should therefore not be placed in a token.

What are the three parts of a JWT?

A JWT has a header, a payload, and a signature, separated by dots. The header states the token type and the signing algorithm. The payload contains the claims, which are statements about the user. The signature is used to verify that the token has not been changed.

Can a JWT be revoked before it expires?

Not easily. Because a JWT is self-contained and is validated without a central store, it remains valid until it expires. Revocation before expiry requires an additional mechanism, such as a short expiry time combined with a list of tokens that are no longer accepted.

A claim is a single statement inside the payload, such as the identifier of the user, the time at which the token expires, or the issuer of the token. Claims are the information that the receiver reads and checks.

Where should a JWT be stored in a browser?

A token should be stored so that it is not exposed to scripts that an attacker might inject. A secure, http-only cookie is generally safer than browser storage that scripts can read. The token should always be transmitted over an encrypted connection.

JWT Tokens Explained

Introduction

A JSON Web Token, commonly written as JWT, is a compact, signed token that carries information about a user or a session. A token is a signed piece of data that represents a fact. A claim is a single statement within the token, such as the identity of the user. This guide explains what a JWT is, why it exists, how it is created and validated, and how it should be handled.

What is it?

A JWT is a string that is composed of three parts, separated by dots. The header states the type of the token and the algorithm that is used to sign it. The payload contains the claims. The signature is a value that is used to verify that the token has not been altered. Each part is encoded so that it can be transmitted safely as text. The token is signed rather than encrypted, which means that its contents can be read, while the signature prevents it from being changed without detection.

Why does it exist?

Traditional sessions require the server to store a record for every signed-in user and to look up that record on each request. This becomes difficult when many servers must share the same session information. A JWT was designed so that authentication can be stateless, meaning that the server does not need to store session records. Because the token is self-contained and signed, any server that holds the signing key can verify it without a central store.

How it works

An issuer, such as Amazon Cognito, creates a token, adds the claims, and signs it with a key. The client stores the token and sends it with each request, usually in the Authorization header with the word Bearer in front of it. The receiver verifies the signature using the key, which confirms that the token is genuine and unaltered. The receiver then checks standard claims, such as the expiration time, the issuer, and the intended audience, before access is granted. The expiration claim states the time after which the token is no longer valid.

Structure diagram

A JWT is three parts joined by dots: header . payload . signature header -> token type and signing algorithm payload -> the claims (user id, expiry, issuer, audience) signature -> verifies the header and payload were not changed The receiver checks the signature, then the claims, before access is granted.

Advantages

Stateless. No session record needs to be stored on the server.
Self-contained. The token carries the claims that the receiver needs.
Standard. The format is widely supported across languages and services.
Scalable. Any server with the signing key can verify the token.

Disadvantages

Difficult to revoke. A token remains valid until it expires, so early revocation requires an additional mechanism.
Readable contents. Because the token is not encrypted, its claims can be read.
Size. A token with many claims can become large and is sent on every request.
Validation required. A token that is not validated correctly provides no security.

Common use cases

Authenticating the calls to an API without a server-side session.
Single sign-on, in which one token proves identity across several applications.
Carrying the identity of a user issued by Amazon Cognito.

Best practices

A short expiration time should be set so that a stolen token is useful only briefly.
The signature and the standard claims should always be verified before access is granted.
Tokens should be transmitted only over an encrypted connection.
Sensitive information should never be placed in the payload, because it can be read.

Common mistakes

The signature is not verified, which allows a forged token to be accepted.
A long or absent expiration time is set, which leaves a stolen token useful for a long period.
Sensitive data is placed in the payload, where it can be read.
The token is stored where a malicious script can read it.

Amazon Cognito issues JSON Web Tokens when a user signs in.
Amazon API Gateway validates these tokens before a request reaches the backend.
AWS Lambda can act as a custom authorizer that validates a token.

Frequently Asked Questions

Is a JWT encrypted?: No, not by default. A standard JSON Web Token is signed but not encrypted, so its contents can be read by anyone who holds it. Sensitive information should not be placed in a token.
What are the three parts of a JWT?: A header, a payload, and a signature, separated by dots. The header states the type and algorithm, the payload contains the claims, and the signature verifies that the token has not been changed.
Can a JWT be revoked before it expires?: Not easily. Because it is self-contained and validated without a central store, it remains valid until it expires. Early revocation requires an additional mechanism, such as a short expiry combined with a list of tokens that are no longer accepted.
What is a claim?: A claim is a single statement inside the payload, such as the identifier of the user, the expiry time, or the issuer. Claims are the information that the receiver reads and checks.
Where should a JWT be stored in a browser?: It should be stored so that it is not exposed to injected scripts. A secure, http-only cookie is generally safer than storage that scripts can read, and the token should always be sent over an encrypted connection.

Go deeper · Book as a Service™

AWS Cognito

This article is the summary. The book is the full, continuously updated reference: tokens, validation, Lambda triggers, securing APIs, and real-world integration.

View the book