Security
JSON Web Token (JWT)
A secure digital ticket used to prove who you are when logging into websites or apps.
Detailed Explanation
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA. You can test this using the JWT Debugger.
Key Technical Takeaways
- Composed of three Base64URL-encoded parts separated by dots: Header, Payload, and Signature.
- Header defines the token type and cryptographic signing algorithm (e.g. HS256).
- Payload contains the claims (e.g. user ID, expiration timestamp, roles).
- Signature verifies that the sender of the JWT is who it says it is and ensures the message was not modified in transit.
Interactive Companion Tool
Try the JWT Debugger
Run calculations and transformations instantly in your browser with zero latency.