JWT Structure and Claims

JSON Web Tokens (JWTs) might look like long, random strings, but they have a very clear and organized structure.

A JWT is composed of three distinct parts, each separated by a dot (.):

• Header
• Payload
• Signature

Think of it like a sealed letter: the header is information about the letter itself, the payload is the message inside, and the signature is the wax seal proving its authenticity.

The Header is the first part of a JWT. It's a JSON object that contains metadata about the token itself, primarily telling us what algorithm was used to sign the token.

It typically includes two key elements:

• alg (Algorithm): Specifies the cryptographic algorithm used for signing the token (e.g., HS256 for HMAC SHA-256, RS256 for RSA SHA-256).
• typ (Type): Indicates the type of token, which is almost always JWT.