SecurityAdvanced 18 min read

Deep Dive into JSON Web Tokens (JWT) and Signature Verification

Understand header, payload, signature mechanics and how to safely verify claims without leaking secrets.

Sarah Chen

Lead Infrastructure Engineer

Published 2/1/2025

1. Anatomy of a Token

A JWT consists of three Base64URL-encoded strings separated by dots: Header.Payload.Signature. The payload is not encrypted—it is merely encoded and readable by anyone.

2. Decoding vs Verifying

Decoding extracts the claims (user ID, expiration, roles) for client-side display. Verifying mathematically checks that the cryptographic signature matches the signing key.

typescript

// Decoded Header sample
{
  "alg": "HS256",
  "typ": "JWT"
}

// Decoded Payload sample
{
  "sub": "usr_9981248",
  "role": "engineer",
  "iat": 1735689600,
  "exp": 1735776000
}

3. Preventing the 'none' Algorithm Exploit

Never trust the algorithm specified in the unverified token header. Hard-code your server verification logic to expect only the specific algorithm you configure.

Interactive Tools Used in This Guide

Try your queries, payloads, or patterns directly in our free browser developer tools:

Base64 Encoder/Decoder