What Is a JWT: Three Parts and a Signature
JWT has three parts: header, payload, signature. Anyone can read the first two. The signature is the only part that needs a key.
JWT (JSON Web Token) is a signed JSON object. It has three parts separated by dots.
Each part is base64url-encoded. Anyone can decode the header and payload. JWT is not encryption. The signature is the only part that needs a key.
| Part | Contains | Anyone can read it? |
|---|---|---|
| Header | Algorithm, token type | Yes, base64 decode |
| Payload | Claims (sub, aud, exp, iss) | Yes, base64 decode |
| Signature | Integrity proof | No, needs the key to verify |
The signature answers one question: “Did someone with the key create this exact header + payload?” If an attacker changes one byte in the payload, the signature breaks.
Warning: JWT does not hide data. Do not put passwords or API keys in the payload.
From the audit: My friend’s side project stored email and displayName in the payload. That was fine. Those are not secrets. But if someone also put a password in there, it becomes public.
“The signature answers ‘was it tampered with?’ It does not answer: who signed it, who it’s for, or whether it’s still valid.”
References:
Related: back to the Seven Blind Spots Behind a JWT Audit overview · Symmetric vs Asymmetric Signing · Six Standard Claims