Anatomy of a JWT
Log in to almost any modern web app and open the browser's network tab. Requests to the API carry a header like this:
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGgu…
That long string is a JSON Web Token (JWT, pronounced "jot"). Its job is to let an API
trust facts about the caller ("this is user-4821, they're support, this is valid until
midnight") without a database lookup on every request. The identity provider signs
the facts once, and every API that can verify the signature can trust them.
You'll take a real token apart in this lesson. It's in token.txt, and the starter
script loads it into $token.
Your script builds up across the steps: each step opens with the previous step's script in the editor, so keep your earlier lines.
6 mini lessons
0 of 6 done- Three parts, split by dots
- Decode the payload properly
- Read the registered claims
- Is it still valid?
- The signature is just bytes
- What the signature protects
Interview prep
JWT questions are standard for backend, platform and security roles. Show you know a JWT is signed, not encrypted.
What are the three parts of a JWT?
Three base64url segments separated by dots: the header (JSON with alg, usually typ, and often kid), the payload (JSON claims such as sub, exp and aud), and the signature over base64url(header) + '.' + base64url(payload). The header and payload are only encoded, so anyone can read them. The signature makes them tamper-evident.
Is the data in a JWT secret?
No. A standard JWT (a JWS) is signed, not encrypted. Anyone who gets the token can base64url-decode the payload and read every claim. Never put secrets, passwords or sensitive PII in it. If you need confidentiality you'd use JWE (encrypted JWTs), or keep the data server-side and put only an opaque ID in the token.
Name the registered claims and what each one is for.
iss is who issued the token. sub is who it's about (the user or client). aud is who it's intended for (the API that should accept it). exp is the expiry time. nbf is not-before. iat is issued-at. jti is a unique token ID, useful for revocation and replay detection. The times are NumericDate: seconds since the Unix epoch, in UTC.