Reading — step 1 of 5
Read
~1 min readJWT Anatomy
Header & Payload
The header is a small JSON object specifying the algorithm:
{"alg":"HS256","typ":"JWT"}
| Field | Meaning |
|---|---|
| alg | Signing algorithm: HS256, HS384, HS512, RS256, ES256, none |
| typ | Always "JWT" (sometimes "JWE" for encrypted) |
| kid | Optional key ID — lets you rotate keys |
The payload is the claims — arbitrary JSON, but with reserved keys:
| Claim | Full Name | Meaning |
|---|---|---|
| iss | issuer | Who created this token |
| sub | subject | User this token represents |
| aud | audience | Who should accept this token |
| exp | expiration time | Unix timestamp when token expires |
| nbf | not before | Unix timestamp before which it's invalid |
| iat | issued at | Unix timestamp when issued |
| jti | JWT ID | Unique token ID (for blacklisting) |
You can also include arbitrary application-specific claims like username, role, permissions, etc. — but prefer keeping JWTs small since they go in every request header.
Discussion
Ask a question, share an insight, or help someone who’s stuck.
Sign in to post a comment or reply.
Loading…