A JSON Web Token (JWT) is a compact format for carrying claims—statements about an issuer, a subject, or a token’s intended use. A JWT can be signed or MAC-protected, encrypted, or nested. The common signed form is readable by anyone who obtains it: Base64URL encoding is not encryption, and a signature protects integrity rather than confidentiality. JWT is a token format, not a complete login or authorization system.
What is a JWT?
RFC 7519 defines JWT as a compact representation of claims suited to space-constrained uses, including HTTP Authorization headers and URI query parameters. Claims are represented as a JSON object. A JWT can carry that object as the payload of a JSON Web Signature (JWS), as plaintext in a JSON Web Encryption (JWE), or in a nested construction combining operations.
The format alone does not establish that a token is trustworthy or appropriate for a particular request. An application or protocol profile must define who may issue it, which recipient may accept it, what its claims mean, and how it is protected and checked.
What is inside a JWT?
Protected header, claims, and signature
A compact signed JWT is commonly serialized as three Base64URL-encoded segments separated by periods: a protected header, a claims payload, and a signature. The header identifies information such as the cryptographic algorithm; the payload contains the claims; and the signature or MAC allows a verifier to check integrity and authenticity under the applicable key and policy. The segments are encoded, not concealed.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Not every JWT has this three-part form. Compact JWE serialization has five components and protects the plaintext using encryption with authenticated encryption. Nested JWTs can combine signed and encrypted representations. An implementation should specify the exact JWS or JWE profile it accepts rather than assume all JWTs serialize or behave alike.
Common registered claims
RFC 7519 registers claim names, but the base specification does not make every registered claim mandatory. An application or a higher-level profile determines which claims must be present and what values it accepts.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
| Claim | Meaning | Validation question |
|---|---|---|
iss |
Issuer: the principal that issued the token. | Does it match the issuer trusted for this token and key? |
sub |
Subject: the principal the token is about. | Is this subject valid for the issuer and the operation? |
aud |
Audience: the intended recipient or recipients. | Does the intended application or resource appear as an acceptable audience? |
exp |
Expiration time: the time after which the token must not be accepted. | Has the token expired, allowing only the documented clock tolerance? |
nbf |
Not-before time: the time before which the token must not be accepted. | Is the token already valid under the documented clock tolerance? |
iat |
Issued-at time: when the token was issued. | Does the issuance time meet the application’s freshness or policy rules? |
jti |
JWT ID: an identifier for the token. | Does the application use it for tracking or replay detection? |
These names have standardized meanings, but their presence and enforcement depend on the application’s rules. In particular, iss and aud are not mandatory in the base JWT specification. If an issuer or key is shared across multiple recipients, the verifier still needs a trusted way—claims or an equivalent profile binding—to establish which issuer and audience apply.
Is a JWT encrypted?
Not necessarily. In the usual three-segment signed form, the payload is readable after Base64URL decoding. Anyone who can obtain the token can inspect its claims, even though they cannot validly alter the signed content without detection. A signature or MAC provides integrity and authenticity under the relevant key; it does not provide confidentiality.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #3
Encryption is used when the JWT is represented as a JWE. If claims are sensitive, do not put them into a readable token on the assumption that encoding or signing hides them. Use encryption where appropriate, and also consider transport security and endpoint authentication so tokens are not disclosed to unintended parties.
How should an application validate a JWT?
Validation is a policy-driven process, not simply decoding the payload or checking that a signature operation succeeds. RFC 8725, the IETF’s 2020 JWT Best Current Practice, describes JWTs as “URL-safe JSON-based security tokens that contain a set of claims that can be signed and/or encrypted.” A verifier should apply the rules for the expected token profile in a controlled sequence:
- Expect a specific serialization and profile. Parse only the JWS, JWE, or nested form the application is designed to accept. Reject malformed input and unexpected token types or structures.
- Apply an algorithm allowlist. Choose permitted algorithms from application policy. Do not let the token’s
algvalue decide which algorithms the verifier will accept. - Resolve keys through a trusted configuration. Obtain verification or decryption keys from the issuer configuration trusted by the application. Treat
kidas an untrusted key-selection hint within that trusted key set, not as permission to fetch or trust an arbitrary key. - Verify every cryptographic operation. For a signed token, verify the signature or MAC. For encrypted or nested tokens, validate all required encryption, authentication, and signing operations. Reject a token if any required operation fails.
- Check issuer and subject binding. Confirm that the issuer is trusted for the key and that the subject is meaningful and permitted for that issuer and use.
- Check the audience. Confirm the token is intended for this recipient or resource, especially where an issuer serves more than one relying party.
- Enforce time and application rules. Check
expandnbfusing a documented clock-skew policy. Enforce required token type, scope, and any other profile-specific claims. - Use claims only after validation succeeds. Reject expired, substituted, malformed, or otherwise invalid tokens; do not treat decoded claim values as evidence before cryptographic validation and trust-context checks pass.
What JWT security mistakes should be avoided?
- Trusting token-selected algorithms. RFC 8725 covers algorithm-confusion risks and acceptance of
alg: none. The verifier must enforce its own permitted algorithms rather than accept a token’s choice. - Using weak shared secrets. HMAC keys need sufficient entropy. A weak secret can undermine the protection expected from a valid MAC.
- Following attacker-controlled key URLs. Headers such as
jkuandx5ucan point to remote key material. Do not blindly follow them; strictly control or whitelist remote key locations to prevent unsafe fetching, including SSRF. - Trusting a valid signature without checking context. A cryptographically valid token can still be wrong for the issuer, subject, audience, type, or operation. RFC 7519 cautions that JWT contents cannot support a trust decision unless they are cryptographically secured and bound to the relevant trust context.
- Ignoring bearer-token exposure and replay. Anyone holding a bearer token may be able to present it. Use secure storage, appropriately short lifetimes, replay detection where appropriate, and a realistic revocation or key-rotation plan.
RFC 8725 also calls for validating cryptographic operations, using keys with sufficient entropy, using UTF-8, binding issuer and subject to trusted keys, and checking audience when an issuer serves multiple relying parties.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How is JWT related to OAuth 2.0 and OpenID Connect?
JWT is used in OpenID Connect ID Tokens and in some OAuth 2.0 access-token and refresh-token deployments, but those protocols add rules beyond the token format. RFC 9068, for example, defines a JWT profile for OAuth 2.0 access tokens. A token’s JWT syntax alone does not tell a recipient which protocol rules to apply.
Best Value
An ID Token conveys authentication information to an OpenID Connect client. An access token authorizes a request to a resource. They serve different recipients and purposes, so a client or API must not treat one as interchangeable with the other merely because both happen to be JWTs.
When is JWT a suitable token format?
JWT is useful when a compact claims representation and the chosen signing or encryption profile fit the deployment. The format also brings trade-offs that should be assessed against the application’s needs; it is not automatically better than an opaque token backed by server-side state.
Quick Recap
| Design question | What to decide |
|---|---|
| Confidentiality | Are readable claims acceptable, or does the deployment require encryption? |
| Revocation | Can acceptance depend on self-contained claims and expiration, or is stateful revocation required? |
| Key distribution | Does the system suit symmetric keys shared by parties, or asymmetric keys that separate signing from verification? |
| Isolation | How will issuer and audience checks prevent tokens from being accepted by the wrong relying party? |
| Transport | Will the serialized token fit the intended headers or other transport channels? |
| Rotation and discovery | How are trusted keys discovered, updated, and rotated without accepting attacker-controlled locations? |
| Replay resistance | Does the operation need replay detection or other protections beyond token integrity and expiration? |
| Profile rules | Which protocol-specific validation requirements apply to this ID token, access token, or other JWT? |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
