Glossary

JWT (JSON Web Token)

A compact, URL-safe token format for securely transmitting claims between parties as a JSON object. It consists of three Base64URL-encoded sections — header, payload, and signature — separated by dots. The signature verifies that the token was not tampered with after issuance.

A JWT (JSON Web Token) is a compact, URL-safe token format for transmitting claims between parties as a signed JSON object. It consists of three Base64URL-encoded segments separated by dots: a header declaring the algorithm, a payload containing claims (data), and a cryptographic signature. Defined in RFC 7519.

Structure

eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature
^--- header ---^       ^-- payload --^    ^- sig -^

{
  "alg": "RS256",
  "typ": "JWT"
}

Payload (Claims)

{
  "sub": "user_123",
  "iss": "https://auth.example.com",
  "aud": "https://api.example.com",
  "exp": 1750000000,
  "iat": 1749996400,
  "jti": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
}

Registered Claims

ClaimNameType
issIssuerURI
subSubjectString
audAudienceURI/Array
expExpirationUnix timestamp
nbfNot BeforeUnix timestamp
iatIssued AtUnix timestamp
jtiJWT IDString (UUID)

Algorithms

  • RS256 (RSA + SHA-256): asymmetric — recommended for public APIs
  • ES256 (ECDSA + SHA-256): asymmetric — smaller signatures than RS256
  • HS256 (HMAC + SHA-256): symmetric — only for single-service use
  • none: no signature — never use in production

Security Rules

  • Always verify the signature server-side before trusting any claim
  • Pin the algorithm server-side — never read alg from the token header
  • Validate exp, iss, and aud on every request
  • Store access tokens in memory, refresh tokens in HttpOnly cookies

Use the JWT Decoder Tool to inspect JWT headers and payloads without sending tokens to external services.