A JSON Web Token (JWT) is a compact, URL-safe token format for transmitting claims between parties. It is commonly used as an access token in OAuth 2 and OpenID Connect (OIDC), where a backend can validate the token and use its claims for authorization. section 11.6 section 12.2.2
A signed JWT has three parts:
- The header contains metadata such as the signing algorithm, key ID, and token type. section 12.2.2
- The payload is a JSON object containing claims such as the subject, username, roles, client identifier, or expiration time. section 11.6 section 12.2.2
- The signature helps verify that the token was not tampered with and remains valid. section 12.2.2
A practical security boundary
An API might receive a JWT containing a subject, name, and issue time. The backend verifies its signature before using the claims. Short-lived access tokens—usually an hour or less—limit the damage if a token is stolen. Configuration still matters: accepting the JWS algorithm value none can disable signature validation, allowing an attacker to modify the payload. Libraries should therefore reject none explicitly. section 12.2.2 section 11.6
Figure 11.7 The collection of standards. JWT builds on top of the JWE and JWS standards. JWT is the token format for the OIDC standard.
Use the standards relationship to distinguish JWT from JWS and JWE: JWT requires a JSON payload, while JWS and JWE can carry other data types; JWT commonly formats OIDC tokens. section 11.6
