JWT Anatomy: Header, Payload, Signature

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It encodes claims (assertions about a subject) and a cryptographic signature in a single string, enabling stateless authentication.

A JWT has the form: base64url(header).base64url(payload).base64url(signature). The dot separates the parts. The header and payload are readable (base64url, not encrypted). Only the signature is cryptographic.

The header is a JSON object: {"alg":"HS256","typ":"JWT"}. alg specifies the signing algorithm (HS256, RS256, ES256, none). typ is always "JWT". Additional headers include kid (key ID) for key selection.

Standard registered claims: iss (issuer), sub (subject), aud (audience), exp (expiry Unix timestamp), nbf (not before), iat (issued at), jti (JWT ID for revocation). Custom claims are any additional key-value pairs.

import base64, json token = "eyJ..." parts = token.split(".") header = json.loads(base64.urlsafe_b64decode(parts[0]+"==")) payload = json.loads(base64.urlsafe_b64decode(parts[1]+"==")) print(header, payload)

For HS256: HMAC-SHA256(base64url(header)+"."+base64url(payload), secret). The receiver recomputes this and compares to the signature part. If they match and the token is not expired, the token is valid.

For RS256: the private key signs the header.payload string using RSA-SHA256. Any party with the public key can verify without the private key. Public keys are distributed via JWKS (JSON Web Key Set) endpoints (e.g., /.well-known/jwks.json).

Base64url replaces + with - and / with _, and omits = padding. This makes JWTs safe in URLs, HTTP headers, and cookies without percent-encoding. The raw bytes are still not encrypted — just encoded.

A JWT payload is visible to anyone who base64url-decodes it. Never put secrets (passwords, SSNs) in a JWT payload unless you use JWE (JSON Web Encryption) with the "enc" algorithm for actual encryption.

Set exp to a short duration (15-60 minutes for access tokens). Long-lived JWTs accumulate risk — if stolen, they remain valid until expiry. Use refresh tokens (stored securely) to issue new short-lived access tokens.

Auth providers (Auth0, Keycloak, Google) publish a JWKS URL. The verifier fetches public keys by kid, caches them, and verifies signatures without contacting the issuer per-request. Key rotation updates the JWKS endpoint.

A JWT is three base64url-encoded JSON parts: header (algorithm), payload (claims), and signature. The payload is readable — not encrypted. Next: choosing between HS256 and RS256.