JWT Structure

 

JWT Structure

The token is composed of three parts, separated by dots:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6Im9wZW5zb3VyY2VqZWdhbkBnbWFpbC5jb20iLCJyb2xlcyI6WyJ1c2VyIl0sImV4cCI6MTczMzU3MzA2MX0.nxBknSlySJ0JQIFg5BpmnZhZV6VZ0Mshu7opFFgPLSc

1. First Part (Header):
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9
When decoded (base64), it reveals:
{
  "typ": "JWT",
  "alg": "HS256"
}
JSON
typ: Type of token (JSON Web Token)
alg: Algorithm used (HMAC SHA256)
2. Second Part (Payload):
eyJ1c2VybmFtZSI6Im9wZW5zb3VyY2VqZWdhbkBnbWFpbC5jb20iLCJyb2xlcyI6WyJ1c2VyIl0sImV4cCI6MTczMzU3MzA2MX0
When decoded, it reveals:
{
  "username": "opensourcejegan@gmail.com",
  "roles": ["user"],
  "exp": 1733573061
}
JSON
username: User's email
roles: User's roles (in this case, "user")
exp: Expiration timestamp (Unix timestamp)
3. Third Part (Signature):
nxBknSlySJ0JQIFg5BpmnZhZV6VZ0Mshu7opFFgPLSc
Created by signing the encoded header and payload with a secret key
Ensures the token hasn't been tampered