The Three-Part Structure of a JWT
A JWT is a string consisting of three dot-separated parts, each Base64Url encoded: 1. **Header** — Contains metadata, typically the algorithm (e.g., HS256) and the token type (JWT). 2. **Payload** — Contains the claims. These are statements about an entity (typically, the user) and additional data like 'sub', 'name', and 'admin'. 3. **Signature** — Ensures the token hasn't been altered. It is created by taking the encoded header, the encoded payload, a secret, and the algorithm specified in the header. Use our [JWT Parser & Debugger](/jwt-parser) to instantly decode these parts and inspect your payload.
HMAC vs RSA — Choosing the Right Signing Algorithm
**HS256 (HMAC with SHA-256)** is a symmetric algorithm. Both the server that creates the token and the server that verifies it must share the same secret string. It is fast and simple, but the secret must be shared securely. **RS256 (RSA Signature with SHA-256)** is an asymmetric algorithm. It uses a private key to sign the token and a public key to verify it. This is ideal for microservices where only the Auth service has the private key, but all other services can verify tokens using the public key. Generate secure secrets for HS256 with our [HMAC Generator](/hmac-generator) or create RSA key pairs with our [RSA Key Generator](/rsa-key-generator).
JWT Security Best Practices
- **Never store sensitive data** in the payload. JWTs are encoded, not encrypted. Anyone who sees the token can read the data. - **Always use HTTPS**. Tokens can be intercepted if transmitted over plain HTTP. - **Validate the 'exp' claim**. Always check the expiration time to prevent replay attacks. - **Use short-lived tokens**. If a token is stolen, the window of risk is minimized. - **Store tokens securely**. In browsers, use HttpOnly, Secure cookies instead of LocalStorage to protect against XSS.
Conclusion
JWTs provide a powerful, scalable way to manage authentication, but they require a "trust but verify" mindset. Always use modern libraries for verification, never trust the 'alg: none' header, and keep your secrets safe. Debug your tokens frequently with our [JWT Parser](/jwt-parser) to ensure your claims are exactly what you expect.