Header:
{
"alg": "HS256",
"typ": "JWT"
}
Contains metadata about the token, including the signing algorithm and token type.
Payload:
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622
}
Contains claims - statements about an entity (typically the user) and additional data. Claims can be registered, public, or private.
Signature:
HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
secret
)
Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
The model's verdict: “”
The interactive diagram is below the answer - jump to diagram ↓
This answer is explained by a shared concept diagram - open →
Tailored explanation · switch back to · ·
Point the redraw: