Three base64 parts
A JSON web token is three base64url encoded sections joined by dots:
- The header, naming the signing algorithm.
- The payload, holding the claims.
- The signature, computed over the header and payload.
Claims
The payload carries claims about the subject. Standard registered claims include iss issuer, sub subject, aud audience, exp expiry, and iat issued at. Applications add custom claims like roles, but should keep tokens small.
Signed, not encrypted
A crucial point: a standard signed JWT is not encrypted. Anyone can base64 decode the payload and read it, so secrets must never be placed inside. The signature only guarantees integrity: it proves the token was not altered and was issued by a holder of the signing key.
Servers must verify the signature and the claims, especially exp and aud. Accepting an unverified token, or trusting the header's algorithm field blindly, is a well known vulnerability.
Key idea
A JWT is a signed header, payload, and signature; the signature guarantees integrity, not secrecy, so the readable payload must hold no secrets.