What's inside a JWT
A JSON Web Token is three Base64URL-encoded parts joined by dots: header.payload.signature. The header and payload are only encoded, not encrypted — anyone holding the token can read them. Never put secrets in a JWT payload.
Registered claims
iss | Issuer |
sub | Subject (usually the user ID) |
aud | Audience |
exp | Expiry time (Unix seconds) |
nbf | Not valid before |
iat | Issued at |
jti | Unique token ID |
Security checklist
- Reject
"alg": "none"on the server, and pin the algorithm you expect. - Always check
exp,audandiss. - HS256 secrets should be at least 32 random bytes.
- Why decode locally? Pasting a live production token into a site that uploads it is a credential leak.