JWT Structure and Claims

A JSON Web Token (JWT) is a compact, URL-safe token format used to securely transmit claims between two parties. In ASP.NET Core it is the most common way to authenticate stateless APIs.

A JWT is just a string made of three Base64Url-encoded parts joined by dots: header.payload.signature.

The header describes how the token is signed. It is a small JSON object that gets Base64Url-encoded into the first segment.

alg names the signing algorithm (e.g. HS256, RS256) and typ is almost always JWT.