Structure
A JSON Web Token has three base64url parts: a header, a payload of claims, and a signature. The signature lets a server verify the token was issued by a trusted party and not altered, without a database lookup.
How Trust Works
- The issuer signs with a secret for HMAC or a private key for asymmetric algorithms.
- Verifiers recompute the signature to confirm integrity.
- The payload is encoded, not encrypted, so never store secrets in it.
Common Pitfalls
- Accepting the alg field from the token can allow an attacker to set it to none or downgrade it; pin the expected algorithm.
- Skipping expiry and audience checks lets stale or misrouted tokens pass.
- Long lived tokens are hard to revoke, so keep access tokens short and use refresh tokens.
Key idea
A JWT is a signed but readable container of claims, so verify the signature with a pinned algorithm and always validate expiry and audience.