Header:
{
"alg": "HS256",
"typ": "JWT"
}
Contains metadata about the token, including the signing algorithm and token type.
Payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622
}
Contains claims - statements about an entity (typically the user) and additional data. Claims can be registered, public, or private.
Signature:
HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
secret
)
Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓
Tailored explanation · switch back to · ·
What should the new diagram focus on?