JWT (JSON Web Token)

A JWT (JSON Web Token) is a compact, URL-safe token format for transmitting claims between parties as a signed JSON object. It consists of three Base64URL-encoded segments separated by dots: a header declaring the algorithm, a payload containing claims (data), and a cryptographic signature. Defined in RFC 7519.

Structure

eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature
^--- header ---^       ^-- payload --^    ^- sig -^

Header

{
  "alg": "RS256",
  "typ": "JWT"
}

Payload (Claims)

{
  "sub": "user_123",
  "iss": "https://auth.example.com",
  "aud": "https://api.example.com",
  "exp": 1750000000,
  "iat": 1749996400,
  "jti": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
}

Registered Claims

Claim	Name	Type
iss	Issuer	URI
sub	Subject	String
aud	Audience	URI/Array
exp	Expiration	Unix timestamp
nbf	Not Before	Unix timestamp
iat	Issued At	Unix timestamp
jti	JWT ID	String (UUID)

Algorithms

• RS256 (RSA + SHA-256): asymmetric — recommended for public APIs
• ES256 (ECDSA + SHA-256): asymmetric — smaller signatures than RS256
• HS256 (HMAC + SHA-256): symmetric — only for single-service use
• none: no signature — never use in production

Security Rules

• Always verify the signature server-side before trusting any claim
• Pin the algorithm server-side — never read alg from the token header
• Validate exp, iss, and aud on every request
• Store access tokens in memory, refresh tokens in HttpOnly cookies

Use the JWT Decoder Tool to inspect JWT headers and payloads without sending tokens to external services.