Wie in Kodieren JWT Tokens

问题

You brauchen in erstellen ein JWT für testing oder understanding der Token Struktur verwendet in authentication.

Voraussetzungen

• Understanding of JSON
• Knowledge of JWT structure (header.payload.signature)

Schritte

1. 1. Define the header and payload

   The header specifies the algorithm (HS256, RS256) and token type (JWT). The payload contains claims: standard (iss, sub, aud, exp, iat) and custom. Set an expiration (exp) to limit token lifetime. Do not put sensitive data in the payload — it is Base64-encoded, not encrypted.

   Eingabe

   header: {alg:'HS256',typ:'JWT'} | payload: {sub:'123',exp:...}

   输出

   claims defined

2. 2. Encode and sign the token

   Base64url-encode the header and payload. Compute the signature by HMAC-SHA256 (for HS256) or RSA-SHA256 (for RS256) over the encoded header.payload. Concatenate as header.payload.signature. The signature ensures the token was not tampered with.

   Eingabe

   header + payload + secret key

   输出

   eyJhbGciOi...eyJzdWIi...SflKxwR...

3. 3. Verify the token structure

   Decode the token and confirm the header and payload are valid JSON. Verify the signature matches by recomputing it. Check the expiration and other claims. Remember that JWT verification only proves the token was signed by the holder of the secret key — it does not encrypt the payload.

   Eingabe

   JWT + secret

   输出

   signature valid, not expired

Erwartetes Ergebnis

Ein gültig, signed JWT das kann sein verified durch anyone mit der signing Schlüssel.

Häufige Fehler

Putting sensitive data in the payload

The JWT payload is Base64-encoded, not encrypted. Anyone can decode it. Never put passwords, secrets, or PII in the payload.

Missing expiration claim

Always set an exp claim to limit the token's lifetime. Tokens without expiration are valid indefinitely, which is a security risk if compromised.

Troubleshooting指引

• If verification fails, check the algorithm, key, and that the token is not expired.
• Use HS256 for symmetric signing (shared secret) or RS256 for asymmetric (private key signs, public key verifies).

Sicherheitsgrenzen

• JWT payloads are readable by anyone. They provide integrity (tamper detection) but not confidentiality.
• This tool encodes and signs locally. Your secret key never leaves your browser.
• JWT is for local token inspection and testing, not for server-side authentication.