The Three-Part JWT Structure
A JSON Web Token (JWT) is a compact, URL-safe string composed of three distinct parts separated by periods (.):
Mathematical Equation
header.payload.signature
1
Header: Contains metadata about the token type (
JWT) and the cryptographic signing algorithm (e.g., HS256, RS256, ES256).2
Payload: Contains the claimsโstatements about an entity (typically the authenticated user) and additional session metadata.
3
Signature: Generated by hashing the base64url-encoded header and payload with a secret key or private key.
Standard Registered Claims
RFC 7519 defines standard claim keys:
Security Best Practices
none algorithm.
