JWT Structure: header.payload.signature

A JWT is three base64url-encoded JSON objects, joined by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ
.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decoded:

header:    {"alg":"HS256","typ":"JWT"}
payload:   {"sub":"1234567890","name":"Jane Doe","iat":1516239022}
signature: HMAC-SHA256(key, base64url(header) + "." + base64url(payload))

The signature is computed over the FIRST TWO parts (header + dot + payload). The base64url encoding has no = padding and uses -/_ instead of +//.

JWTs are signed but NOT encrypted. Anyone can decode the header and payload (just base64). The signature only proves authenticity. Never put secrets in a JWT unless you also encrypt it (JWE).