Understand JSON Web Tokens
JSON Web Token, commonly called JWT, is a compact token format used to transfer claims between parties.
A signed JWT contains three sections separated by dots:
- Header.
- Payload.
- Signature.
Example structure:
header.payload.signature
The header describes the token type and signing algorithm.
The payload contains claims such as:
- sub: Subject or user identifier.
- iat: Issued-at timestamp.
- exp: Expiration timestamp.
- iss: Issuer.
- aud: Audience.
The signature allows the receiving server to verify that the token has not been modified.
A signed JWT is not automatically encrypted. Its payload can generally be decoded by anyone who possesses the token.
Never store passwords, API secrets, or sensitive personal information inside an ordinary signed JWT payload.
JWT Authentication Flow
Key Takeaways
JWT contains a header, payload, and signature.
Signed JWT payloads are not automatically encrypted.
Verify the token signature and claims before trusting it.