Understanding JSON Web Tokens (JWT): Header, Payload, and Signature Architecture

By Evorenza Engineering • Category: Security & Privacy

What is a JSON Web Token?

Defined in RFC 7519, a JSON Web Token (JWT) is a compact, URL-safe container for transferring claims between two parties. JWTs are widely used for stateless authentication in modern SPAs and APIs.

A JWT consists of three parts separated by periods: Header, Payload, and Signature.

The Three Segments Explained

  1. Header: Contains metadata about token type and algorithm (HS256, RS256).
  2. Payload: Contains statements about the user and timestamps (sub, iat, exp).
  3. Signature: Cryptographic hash verifying integrity.

Crucial Rule: Decoding is NOT Verifying

Remember that decoding a JWT's payload merely reveals the JSON claims; anyone with the token string can read its contents. Never place confidential secrets or passwords inside a JWT payload.