What is a JWT?

A standardized format for sending cryptographically signed JSON data between systems. Used for authentication, session handling, and access control — all data is stored client-side within the token itself.

JWT Structure

A JWT always consists of three parts separated by dots (.): Header.Payload.Signature (Looks like: xxxxx.yyyyy.zzzzz)

1. Header (The Metadata)

Acts as the token's ID card. It tells the server how to process and verify the token.

• typ (Type): Usually set to JWT.
• alg (Algorithm): The hashing/signing algorithm being used (e.g., HS256, RS256, or none).
• kid (Key ID): An optional parameter indicating which specific key the server should use to verify the signature.

{
  "alg": "HS256",
  "typ": "JWT",
  "kid": "key_1"
}

This JSON is Base64URL encoded to form the first part of the token (xxxxx).

2. Payload (The Claims)

The core of the token where the actual user data (claims) is stored.

• Registered Claims: Standardized fields for interoperability.
  • iss (Issuer): Who created the token.
  • sub (Subject): Who the token is about (often the User ID).
  • exp (Expiration Time): Unix timestamp when the token expires.
  • iat (Issued At): When the token was created.
• Public/Private Claims: Custom application data like user roles or identifiers.

{
  "sub": "1234567890",
  "name": "Muhab",
  "role": "admin",
  "exp": 1718582400
}

This JSON is also Base64URL encoded to form the second part of the token (yyyyy).

3. Signature (The Security Seal)

The signature is what makes the JWT secure. It guarantees two things: