JWT Comprehensive Guide: Structure, Security and Online Decode
JSON Web Token (JWT) It is an open standard based on JSON (RFC 7519) designed to transport statements safely across multiple systems. (Claims)。 Because of its light-quantitative, self-inclusion characteristics, JWT has become modern authentication and authorization. (Authorization) The preferred option.
1. JWT ' s Core Structure
A standard JWT token consists of three parts, through dot number (in the form of a coded code).
.
) Separating:
- Header (head): Includes token type (JWT) and signature algorithms (e. g. HS256 or RS256).
-
Payload (load):
Store core business data (declarations), e.g. user ID (
sub), expiry time (exp) and the time of publication (iat)。 - (Signed): Signaure The data is used to verify whether the data is tampered with.
Description of common standard payload
-
iss(Issuer): The issuer of the token. -
sub(Subject): The user ID for which the token is directed. -
exp(Expiration Time): Expires. -
iat(Issued At): Time stamp issued. -
jti(JWT ID): The token is the only identifier.
Security alert: Do not store secrets in Payload!
This is a common error zone: JWT's Header and Payload only pass Base64 code and are not encrypted. Anyone who gets your JWT can read all of it through this tool. So, never in Payload. Stores passwords, credit card numbers or any sensitive privacy data.
4. How to use this tool to solve the challenge of debugging
Scene one: Token expired.
Paste Token to this tool, view
exp
field. If that time is earlier than the current time, it means that Token is no longer valid.
Scene 2: Signing anti-false-fixing test. Enter your known Secret in the Validation Signature box, which indicates that your signature logic is perfectly correct if the hint is " signature is valid " .
Common Question Answers (FAQ)
Q: Why did I change Payload and then the signature doesn't work?
A: Signature based on Header and Payload Co-generated. Any minor changes to these two parts would result in the recalculated signature not matching the original signature.
Q: Do KiloCell of JWT decodors save my Token?
A: Absolutely not. This tool is fully run in your browser sandbox and does not communicate with the back server. Your token and all the data you contain are in absolute privacy.