JSON Web Token (JWT)
A compact, URL-safe container format for encoding JSON objects as cryptographically signed (JWS) or encrypted (JWE) tokens exchanged between distributed systems.
Entity Relationships (GEO Conceptual Hierarchy)
Taxonomy ModelTechnical Explanation & Operational Mechanics
A JSON Web Token consists of three base64url-encoded parts separated by periods: the Header (specifying cryptographic algorithm and token type), the Payload (containing application claims such as subject, issuer, and expiration time), and the Signature (computed over the header and payload using HMAC or RSA/ECDSA). Because the signature guarantees authenticity and tamper-detection, recipient microservices can independently verify and trust the contained identity claims without querying a centralized database or shared cache on every request.
Technical Example & Practical Implementation
The three Base64URL components of a standard JWS token
// Structure: header.payload.signature
// 1. Header (Base64URL decoded):
{
"alg": "HS256",
"typ": "JWT"
}
// 2. Payload Claims (Base64URL decoded):
{
"sub": "usr_998124",
"name": "Alex Mercer",
"role": "admin",
"iat": 1728100000,
"exp": 1728103600
}
// 3. Signature computation:
HMACSHA256(
base64UrlEncode(header) + "." + base64UrlEncode(payload),
secretKey
)Related Topic Ecosystem & Next Steps
Related Technical Articles
JWT vs Session-Based Authentication: Architecture & Performance
Compare database session lookups with stateless JWT verification across scalability and revocation.
Troubleshooting: JWT Works in Postman but Fails in Browser
Diagnose and remediate CORS header stripping, HttpOnly cookie constraints, and preflight authorization failures.
Developer References & Specifications
Continue Learning
JWT Interactive Tampering & Validation Lab
Put your theoretical understanding into practice by tampering with claims and testing signature rejection in the live sandbox.