← Anatomy of a JWT
Three parts, split by dots
Learn
Three segments, two dots
xxxxx.yyyyy.zzzzz
header.payload.signature
Each segment is base64url-encoded (the URL-safe base64 from lesson 1: - and _
instead of + and /, padding stripped).
- Header: JSON describing the token, mainly
alg(the signing algorithm) andtyp. Often there's also akid(key ID) saying which key signed it. - Payload: JSON claims, the facts the token asserts.
- Signature: the bytes of
HMAC-SHA256(key, base64url(header) + "." + base64url(payload))forHS256, or a public-key signature forRS256/ES256/EdDSA.
cut -d. -f1 takes the first segment. The header usually decodes with plain base64 -d.
Your task
A JWT is three base64url segments joined by .. Print the decoded header: the first segment of $token, base64-decoded.