What is JWT (JSON Web Token)?

A format for passing information (claims) in JSON form with a signature attached. Its three parts, "header.payload.signature", are each encoded with Base64URL and joined with ".". The signature lets the receiver check for tampering and confirm the issuer, but in a typical signed JWT the payload is not encrypted, so no secret information should be put in it. It is used for access tokens for API authentication and for OpenID Connect ID tokens, among others, and is usually given a short expiry (exp).

Japanese name: JWT(JSON Web Token)

JWT (JSON Web Token) appears in 2 practice questions across 1 topic, including Web Technology Basics.

Field: Web Technology Basics

The three parts

The header holds the signature algorithm (for example HS256) and the type; encoding {"alg":"HS256","typ":"JWT"} with Base64URL gives eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. The payload holds claims such as the user identifier (sub), the issuer (iss) and the expiry (exp). The signature is computed over the encoded header and payload joined with ".", using an HMAC with a shared secret key or the private key of a public-key algorithm.

How the server checks it

A server that receives a JWT checks with the key that the signature is valid, and checks that claims such as the expiry and the audience (aud) meet its conditions. It is important not to trust the alg value in the header as is, but to accept only the algorithms decided on the server side. Once the signature is checked, the server can tell whom the token was issued to without storing any session information.

Points to watch

Because a JWT is hard to revoke once issued, it is common to give it a short expiry and, for longer use, to reissue it with a separate value used for renewal. Anyone can read the payload, so no secret information is put in it. Depending on where it is stored in the browser, it may be stolen through XSS.

Try it: questions about JWT (JSON Web Token)

Which of the following correctly describes a typical signed JWT (JSON Web Token)?

AThe payload is encrypted with the signing key, so passwords or credit card numbers put in it cannot be read along the way
BEven after a token has expired, the server must accept it as long as the signature is valid, because it has not been tampered with
CIt consists of a header, a payload and a signature, each encoded with Base64URL and joined with "."; the signature detects tampering, but the contents are not encrypted

Show answer and explanation

Answer: C. It consists of a header, a payload and a signature, each encoded with Base64URL and joined with "."; the signature detects tampering, but the contents are not encrypted

A JWT has three parts, "header.payload.signature": the header holds the signature algorithm (for example HS256), and the payload holds information (claims) such as the user identifier and the expiry (exp). The signature is made from the header and payload with a secret key, so a server that receives the token can confirm that the contents have not been tampered with and who issued it. However, Base64URL is not encryption, and anyone can decode and read it, so no secret information is put in it. When sent to an API, the token is generally placed after Authorization: Bearer.

FAQ

Should I use a JWT or a session ID?

A session ID is just a key for looking up information stored on the server, so logouts and invalidations take effect immediately on the server side. A JWT can be checked without storing information on the server, which suits passing it between several services, but it has the weakness of being hard to revoke. For logging in to a single website, a session ID is often easier to handle.

What is the difference between Base64URL and Base64?

Base64URL is a variant of Base64 that replaces "+" and "/", which have special meanings in URLs, with "-" and "_", and often omits the trailing "=". JWTs use this form so that they can be put into URLs and HTTP headers as they are. Neither is encryption; anyone can decode them.

JWT (JSON Web Token) in the explanations

A JWT has three parts, "header.payload.signature": the header holds the signature algorithm (for example HS256), and the payload holds information (claims) such as the user identifier and the expiry (exp).
Which of the following correctly describes a typical signed…
OpenID Connect adds to the OAuth 2.0 flow an ID token in the form of a signed JWT.
Which of the following correctly describes the relationship…

Questions that mention JWT (JSON Web Token) (2)

Books on Web Technology Basics Ad

Search Amazon for semiconductor Web Technology Basics

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary