Understanding JSON Web Tokens (JWT)
JWT Structure (RFC 7519)
JSON Web Tokens (JWT), defined in RFC 7519, are a compact, URL-safe means of representing claims transferred between two parties. A JWT consists of three Base64URL-encoded parts separated by dots (.): the Header, Payload, and Signature.
Standard JWT Claims (RFC 7519 §4.1)
| Claim | Full Name | Description |
|---|---|---|
| iss | Issuer | Identifies the principal that issued the JWT |
| sub | Subject | Identifies the principal that is the subject of the JWT |
| aud | Audience | Identifies the recipients the JWT is intended for |
| exp | Expiration Time | Unix timestamp after which the JWT must not be accepted |
| nbf | Not Before | Unix timestamp before which JWT must not be accepted |
| iat | Issued At | Unix timestamp when the JWT was issued |
| jti | JWT ID | Unique identifier for the JWT (prevents replay attacks) |
Common JWT Signing Algorithms
HS256— HMAC-SHA256 (symmetric, shared secret)RS256— RSA-SHA256 (asymmetric, public/private key pair)ES256— ECDSA-SHA256 (elliptic curve, compact signatures)PS256— RSASSA-PSS-SHA256 (RSA with probabilistic signature scheme)
⚠️ Security Warning
JWTs are Base64URL-encoded, not encrypted. Sensitive data in the payload is readable by anyone who has the token. Use JWE (JSON Web Encryption, RFC 7516) if payload confidentiality is required.