What are the three parts of a JWT?

A JWT (JSON Web Token) is like a hall ticket with a stamp. The ticket lists your details, and the stamp from the exam board shows nobody edited it. Anyone can read the details; only the board can produce a valid stamp.

It looks like xxxxx.yyyyy.zzzzz:

1. Header: { "alg": "HS256", "typ": "JWT" }, which tells how it is signed.
2. Payload: the claims, such as { "sub": "42", "role": "student", "iat": 1760000000, "exp": 1760000900 }. sub is the subject, iat the issue time, exp the expiry time, both in seconds.
3. Signature: computed over base64url(header) + "." + base64url(payload) using a secret (HS256) or a private key (RS256).

const jwt = require("jsonwebtoken");

const token = jwt.sign(
  { sub: "42", role: "student" },
  process.env.JWT_SECRET,
  { expiresIn: "15m" }
);

try {
  const claims = jwt.verify(token, process.env.JWT_SECRET);
  console.log(claims.sub);           // 42
} catch (err) {
  console.log(err.name);             // TokenExpiredError or JsonWebTokenError
}

verify recomputes the signature and checks exp. If someone edits the payload, the signature no longer matches and verification fails. Always use verify, not decode, since decode skips the check.

• Using jwt.decode and treating the result as trusted.
• Forgetting to set an expiry.