100% Client-Side Computation • Zero Server Logs • Instant Execution
Curious TechieDev Toolbox
← All Guides/Authentication•8 min read

What is JWT? JSON Web Token Architecture (RFC 7519)

Stateless authentication, header/payload/signature structure, Base64URL, algorithm confusion attacks, and why decoding is not verifying.

ⓘKey Takeaways
  • A JWT consists of three dot-separated components: Header, Payload, and Signature.
  • Data is encoded in Base64URL, meaning any client can inspect the claims without needing the private secret.
  • Decoding a JWT is NOT verifying it: verification requires recomputing the signature using HMAC secret or RSA public key.
  • The critical alg: "none" vulnerability occurs when insecure backends accept unsigned tokens.
  • JWTs are stateless, making immediate server-side revocation challenging without token deny-lists.

In modern stateless microservices and OAuth 2.0 / OpenID Connect authentication architectures, JSON Web Tokens (JWT) serve as the standard mechanism to securely transmit identity claims between a client and a resource server.

1. The 3-Part Token Anatomy

A JWT string consists of three base64url-encoded parts separated by periods (.):

1. Header (Red)Algorithm & Token Type
2. Payload (Purple)Claims & User Data
3. Signature (Blue)Cryptographic Proof

2. Standard Registered Claims (iss, exp, sub)

  • iss (Issuer): The entity that created and issued the token.
  • sub (Subject): The user ID or unique principal identity.
  • exp (Expiration Time): Unix epoch timestamp after which the token must be rejected.
  • iat (Issued At): Timestamp when the token was created.

3. Symmetric (HS256) vs Asymmetric (RS256) Signing

HS256 (HMAC-SHA256) uses a single shared secret key known to both the token issuer and consumer. RS256 (RSA-SHA256) uses a private key to sign the token and a public key (JWKS) to verify it, allowing third parties to verify token integrity without possessing signing capability.

4. Critical Security Pitfalls & Vulnerabilities

Common vulnerabilities include accepting the "alg": "none" header, storing sensitive tokens in unencrypted localStorage (susceptible to XSS), and failing to validate the token signature before trusting payload claims.