JWT Structure Explained: Header, Claims, and Signatures

Registered Standard Claims

RFC 7519 defines recommended standard claims in the JWT payload:

iss (Issuer): Identifies the authorization server that issued the token.
sub (Subject): The principal identifier (e.g. unique User ID).
aud (Audience): The target resource server or API client.
exp (Expiration Time): Unix epoch timestamp identifying when token expires.
iat (Issued At): Unix epoch timestamp when token was created.
nbf (Not Before): Unix timestamp before which token must not be accepted.

Symmetric vs. Asymmetric Signing

HMAC (e.g. HS256): Uses a shared secret key for both signing and verification. Ideal for internal microservices sharing a secure config.
RSA / ECDSA (e.g. RS256, ES256): Uses a private key to sign the token and a public key (JWKS) to verify signatures. Standard for multi-tenant OAuth/OIDC providers (Auth0, Okta, Google).

Try Related Tools on ToolNest

JWT Decoder

Decode and inspect JSON Web Tokens (JWT) client-side. View header algorithms, payload claims, expiration timestamps, and active status without transmitting tokens.

🔓

Base64 Decoder

Decode Base64 encoded strings back into clean, readable text. Full UTF-8 and multilingual character support with instant error detection for corrupted payloads.

⏱️

Unix Timestamp Converter

Convert Unix epoch timestamps (seconds and milliseconds) to human-readable UTC and local date formats, or convert dates into Unix epoch seconds.

Related Technical Guides

Security & Auth

What Is a JWT? JSON Web Tokens & Stateless Authentication

Learn what JSON Web Tokens (JWT / RFC 7519) are. Understand stateless authentication, Bearer tokens, token anatomy, and client-side decoding vs verification.

Cryptography & Security

Hashing vs. Encryption: When to Use SHA-256 vs. AES vs. Argon2

Learn the vital differences between cryptographic hashing and encryption. Explore SHA-256 for data integrity, AES for data confidentiality, and Argon2/bcrypt for passwords.