Introduction to JWT

JSON Web Token (JWT) is an open standard (RFC 7519) that enables the exchange of information between parties in a networked environment. Designed to be compact and secure, it is particularly well-suited for Single Sign-On (SSO) scenarios across distributed systems. The claims within a JWT are typically used to pass authenticated user identity information between an Identity Provider and a Service Provider, facilitating access to resources on the resource server. Additionally, extra claims required for other business logic can be included. The token can be used directly for authentication purposes and may also be encrypted.

Since JWTs can be signed—for example, using a public/private key pair—the sender's identity can be verified to ensure they are indeed the person claiming to be. Furthermore, because the signature is computed over the header and payload, it allows you to verify that the content has not been tampered with.

JWT Structure

A JWT consists of three parts: the Header (header), the Payload (payload), and the Signature (signature). These three segments are concatenated using a period (.) to form the complete JWT string.

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": 1516239022
  },
  "signature": "base64-encoded-signature"
}