This tells us that we have a JWT that is integrity protected with the HMAC SHA-256 algorithm. For example, take a look at the following header: The header includes information about how the JWT claims set, the payload, is encoded. The main parts are encoded then concatenated with a “.” separating them, so that it looks like Signature: An encoding of the header and payload.Header: The type of encoded object in the payload and any extra encoding.There are three main parts of a JWS or JWE that include a JWT claim: However, the entire string is often referred to as a JWT if the payload is an encoded JWT object. Technically, a JWT is represented as a JWS (JSON Web Signature) object or a JWE (JSON Web Encryption) object. They can be encrypted or digitally signed so the information can be passed around securely.Compact representation of information about a subject or user.

Instead, your information can be passed between domains in the JWT, so the second domain knows who you are and that you have already been authenticated by a trusted party. This can enable single sign-on (SSO), which means you do not have to sign in again to another domain owned by the same company. A JWT is an open-standards approach to securely sharing information between a client and a server in a compact, self-contained way that provides stateless authentication.įor example, after you sign in to a website, information about your account is encoded and passed around to the relevant parties in a JWT. Claims are encoded JSON objects that include some information about a subject and are often used in identity security applications to transfer information about a user. A JSON Web Token (JWT, pronounced “jot”) is a token for sharing claims.

Decode token online