Understanding JSON Web Token (JWT) Architecture & RFC 7519
A JSON Web Token (JWT) is an open, industry-standard RFC 7519 method for securely transmitting information between parties as a compact, URL-safe JSON object. In modern cloud architecture, microservices, OAuth 2.0, and OpenID Connect (OIDC), JWTs serve as stateless access tokens carrying authentication claims and authorization roles.
1. Anatomy of the Three Segments
A standard JWT string consists of three parts separated by periods (header.payload.signature):
- Header: Specifies the cryptographic algorithm (e.g.,
HS256HMAC-SHA256,RS256RSA Signature, orES256ECDSA) and token type (JWT). - Payload: Contains standard and custom claims (statements about an entity, usually the authenticated user) along with metadata like timestamps. The payload is Base64Url encoded, meaning it is readable by anyone with access to the raw string.
- Signature: Generated by hashing the encoded header, encoded payload, and a secret key or private key. This ensures the token cannot be tampered with or forged in transit.
2. Standard Registered Claims Reference
| Claim | Full Name | Technical Purpose |
|---|---|---|
| sub | Subject | Unique principal identifier (e.g., user UUID or database ID). |
| exp | Expiration Time | Unix timestamp (seconds) identifying when the token expires and must be rejected. |
| iat | Issued At | Unix epoch seconds marking the exact instant the token was minted. |
| iss | Issuer | Identity of the authorization server that generated the token (e.g., Auth0, Firebase, Keycloak). |
| aud | Audience | Identifies the intended recipients or backend API resource servers for this token. |
Frequently Asked Questions (FAQ)
Is it safe to paste confidential production JWTs into this debugger?+
Yes, 100% safe. This debugger executes entirely in your browser's local JavaScript runtime using Base64Url parsing. No headers, tokens, secret signatures, or payload values are ever transmitted to any remote backend server.
Does decoding a JWT verify that the signature is authentic?+
No. Decoding unpacks and displays the Base64Url-encoded Header and Payload claims. Cryptographic signature verification requires the asymmetric public key (RS256/ES256) or symmetric shared secret (HS256) strictly stored inside your authentication authority or backend microservices.
Why are JWT tokens encoded and not encrypted by default?+
Standard JWTs (RFC 7519) are digitally signed, not encrypted (JWE). This means anyone in possession of the token can read the payload claims. Because of this, sensitive information such as database passwords, API secret keys, or credit card numbers must never be placed inside a JWT payload.