How JSON Web Token (JWT) Authentication Works Under the Hood

Introduction to JSON Web Tokens

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

In modern web architectures, JWTs are commonly used for stateless authorization. Once a user logs in, the authentication server generates a token containing claims about the user and signs it. For subsequent requests, the client transmits this token, allowing the resource server to authenticate the user without querying a central database or session store.

The Structure of a JWT

In its compact form, a JSON Web Token consists of three parts separated by dots (.):

Header.Payload.Signature

1. The Header

The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 (HS256) or RSA SHA256 (RS256).

{
  "alg": "HS256",
  "typ": "JWT"
}

This JSON is then Base64Url encoded to form the first part of the JWT.

2. The Payload

The payload contains the "claims." Claims are statements about an entity (typically, the user) and additional metadata. There are three types of claims: Registered, Public, and Private claims.

3. The Signature

To create the signature part, you must take the encoded header, the encoded payload, a secret key, the algorithm specified in the header, and sign them:

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secretKey
)