Curious TechieDev Toolbox
← All Guides/Encoding & Cryptography•8 min read

Comprehensive Guide to JSON Web Tokens (JWT)

Explore the RFC 7519 standard, token structure (Header, Payload, Signature), common claims (sub, exp, iss), and client-side security.

ⓘKey Takeaways
  • A JWT is a compact, URL-safe token defined by RFC 7519 consisting of 3 dot-separated parts: Header.Payload.Signature.
  • The Header and Payload are simply Base64URL-encoded JSON objects — they are NOT encrypted.
  • The third part (Signature) cryptographically verifies token authenticity using HMAC secret keys or RSA/ECDSA public keys.
  • Tokens should always validate the exp (expiration) and iss (issuer) claims to prevent replay vulnerabilities.

In modern stateless microservices and OAuth 2.0 / OpenID Connect authentication architectures, JSON Web Tokens (JWT) serve as the standard mechanism to securely transmit identity claims between a client and a resource server.

1. The 3-Part Token Anatomy

A JWT string consists of three base64url-encoded parts separated by periods (.):

1. Header (Red)Algorithm & Token Type
2. Payload (Purple)Claims & User Data
3. Signature (Blue)Cryptographic Proof

2. Standard Registered Claims (iss, exp, sub)

  • iss (Issuer): The entity that created and issued the token.
  • sub (Subject): The user ID or unique principal identity.
  • exp (Expiration Time): Unix epoch timestamp after which the token must be rejected.
  • iat (Issued At): Timestamp when the token was created.

3. Symmetric (HS256) vs Asymmetric (RS256) Signing

HS256 (HMAC-SHA256) uses a single shared secret key known to both the token issuer and consumer. RS256 (RSA-SHA256) uses a private key to sign the token and a public key (JWKS) to verify it, allowing third parties to verify token integrity without possessing signing capability.

4. Critical Security Pitfalls & Vulnerabilities

Common vulnerabilities include accepting the "alg": "none" header, storing sensitive tokens in unencrypted localStorage (susceptible to XSS), and failing to validate the token signature before trusting payload claims.