# JWT Explorer (CTF challenge)

> After you log in, AuthLab issues a JSON Web Token (JWT). A JWT is three Base64URL parts joined by dots — header.payload.signature — and the payload is NOT encrypted.

Canonical: https://codelivly.com/ctf/challenges/jwt-explorer

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Easy |
| Points | 100 |
| Estimated time | 10 min |
| Type | Live instance |
| Solves | 64 |
| Author | Codelivly |

After you log in, AuthLab issues a JSON Web Token (JWT). A JWT is three Base64URL parts joined by dots — header.payload.signature — and the payload is NOT encrypted. Log in with student / learn123, then decode the token's payload to read the flag. No cracking or bypass needed — this is about understanding JWT structure.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)