📖 JSON Web Token (JWT) Architecture & Decoding Guide

Understand JWT structure (Header, Payload, Signature), Base64URL encoding, claims (iss, sub, exp), and security checks.

← Dashboard

Anatomy of a JSON Web Token (RFC 7519)

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.

A JWT consists of three parts separated by dots (`.`): Header, Payload, and Signature (`header.payload.signature`). The header specifies the algorithm (`alg`), the payload contains claims (`sub`, `exp`, `iat`, user roles), and the signature verifies authenticity.

Base64URL Encoding vs Standard Base64

JWT segments use Base64URL encoding (RFC 4648 §5), which replaces `+` with `-` and `/` with `_`, and omits trailing `=` padding characters to ensure tokens can be safely passed in URL query parameters and HTTP headers.

Frequently Asked Questions

Detailed specifications & guides FAQs.