Understanding JWT Structure: Header, Payload, and Standard Claims

JSON Web Tokens (JWT) are an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.

The Three Components of a JWT

A JWT is represented as three base64url-encoded string blocks separated by dots (.):

1. The Header

The header typically consists of two parts: the type of the token (JWT) and the signing algorithm being used, such as HMAC SHA256 or RSA.

{
  "alg": "HS256",
  "typ": "JWT"
}

2. The Payload

The payload contains the claims. Claims are statements about an entity (typically, the user) and additional metadata. There are three types of claims: registered, public, and private claims.

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iat": 1516239022
}

3. The Signature

To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret
)

Standard Registered Claims

Here are the most common registered claims defined in the specification:

• iss: Issuer of the token.
• sub: Subject of the token (e.g. user ID).
• aud: Audience for whom the token is intended.
• exp: Expiration time timestamp (seconds since epoch).
• nbf: "Not Before" time timestamp.
• iat: "Issued At" time timestamp.