Understanding JSON Web Tokens (JWT) & Architecture
A JSON Web Token (JWT) is an open RFC 7519 industry standard for securely transmitting information as a compact, self-contained JSON object between client applications and servers. JWTs are widely used in web applications for user authentication, session management, OAuth 2.0 authorization flows, and microservice information exchange.
The Three Parts of a JSON Web Token
A JSON Web Token consists of three distinct parts separated by dots (.): Header.Payload.Signature.
1. Header
Contains metadata about the token, including the signature algorithm used (e.g., HS256 or RS256) and the token type (JWT).
2. Payload
Contains the claims—statements about the user entity (such as user ID, role, or permissions) along with token metadata like expiration times.
3. Signature
Calculated by signing the encoded header and payload with a secret key to ensure the token has not been tampered with in transit.
Standard Registered JWT Claims Explained
RFC 7519 defines several recommended registered claims used to manage token lifecycles and security:
-
exp(Expiration Time) A Unix timestamp specifying when the token expires. Authentication middleware rejects any request presenting a token past this time. -
iat(Issued At) The Unix timestamp recording when the authentication server generated the token. -
sub(Subject) Identifies the principal entity or user ID associated with the token payload. -
iss(Issuer) Identifies the authorization server or identity provider that issued the JWT.
Is Client-Side JWT Decoding Secure?
Yes! Our JWT Decoder processes tokens 100% client-side inside your browser using JavaScript. Your security tokens, user data, and authentication headers are never transmitted to our web server, ensuring complete privacy and data security while debugging.