The Software Engineer's Guide to JSON Web Tokens (JWT)
JSON Web Tokens (JWT) specified under RFC 7519 serve as the foundation of modern stateless authentication across microservices, RESTful APIs, and single-page applications (SPAs).
1. Anatomical Breakdown of a JWT Token
A standard JWT string consists of three distinct Base64Url-encoded segments separated by periods (`.`):
- Header (Red): Declares the signing algorithm (e.g. `HS256`, `RS256`) and token type (`JWT`).
- Payload (Purple): Contains registered claims (such as `sub`, `iss`, `exp`, `iat`) alongside custom application user roles and permission scopes.
- Signature: Cryptographic hash constructed by combining the encoded header, payload, and a secret key to prevent payload tampering.
2. Essential Registered Claims for API Security
Implementing registered claim parameters ensures robust session management:
- `exp` (Expiration Time): Unix timestamp marking when the token expires and must be rejected.
- `iat` (Issued At): Identifies the exact creation timestamp of the token.
- `sub` (Subject): Unique user ID or entity identifier.
- `iss` (Issuer): Identifies the authentication server authority that issued the token.
3. Why Client-Side JWT Parsing Protects Privacy
Decoding authorization tokens in the browser ensures that sensitive user claims and session IDs are never logged by middleman proxy servers. Our tool executes 100% locally using native JavaScript Base64Url decoding.