GUIDE深度 · Deep dive
The Three Parts of a JWT
A JWT has three dot-separated parts: the header describes algorithm/type, the payload holds claims, and the signature is derived from the first two plus a key. The first two are only Base64URL and anyone can decode them.
Three parts
Header: {"alg":"HS256","typ":"JWT"}.
Payload: claims such as sub/iat/exp.
Signature: HMAC/RSA/ECDSA output.
Common claims
iss issuer, aud audience, sub subject.
exp expiry, nbf not-before, iat issued-at (seconds).
FAQ
Is JWT encrypted?
A normal JWS is not encrypted; JWE is.
What is alg=none?
No signature; servers must reject it.