https://lesitedefrancois.be/en/tags/oauth2/Recent content in Oauth2 on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/jwt/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/jwt/<p><strong>JWT (JSON Web Token)</strong>, standardised in RFC 7519, is a compact, self-contained token format that encodes a set of <strong>claims</strong> — assertions about a subject, an issuer, an audience, and arbitrary application-defined attributes — as a JSON object, signs or encrypts it, and serialises the result as three base64url-encoded segments separated by dots: <code>header.payload.signature</code>. The header is a JSON object specifying the algorithm (<code>alg</code>) and optionally a key ID (<code>kid</code>) used to produce the signature. The payload is a JSON object containing the claims. The signature is computed over <code>base64url(header) + &quot;.&quot; + base64url(payload)</code> using the algorithm declared in the header. The entire token is URL-safe, fits in an HTTP header or query parameter, and is self-describing — a verifier can locate the signing key, check the algorithm, verify the signature, and read the claims without any external lookup beyond fetching the issuer&rsquo;s public key. This self-contained nature is what makes JWTs efficient at scale: unlike opaque tokens, which require a network call to the issuer&rsquo;s introspection endpoint per verification, a JWT can be verified locally with a cached public key, making it suitable for high-throughput API gateways and distributed systems.</p>