Cómo a Codificar JWT Tokens

问题

You necesitar a crear un JWT para testing o understanding el token estructura usado en authentication.

Requisitos previos

• Understanding of JSON
• Knowledge of JWT structure (header.payload.signature)

Pasos

1. 1. Define the header and payload

   The header specifies the algorithm (HS256, RS256) and token type (JWT). The payload contains claims: standard (iss, sub, aud, exp, iat) and custom. Set an expiration (exp) to limit token lifetime. Do not put sensitive data in the payload — it is Base64-encoded, not encrypted.

   entrada

   header: {alg:'HS256',typ:'JWT'} | payload: {sub:'123',exp:...}

   输出

   claims defined

2. 2. Encode and sign the token

   Base64url-encode the header and payload. Compute the signature by HMAC-SHA256 (for HS256) or RSA-SHA256 (for RS256) over the encoded header.payload. Concatenate as header.payload.signature. The signature ensures the token was not tampered with.

   entrada

   header + payload + secret key

   输出

   eyJhbGciOi...eyJzdWIi...SflKxwR...

3. 3. Verify the token structure

   Decode the token and confirm the header and payload are valid JSON. Verify the signature matches by recomputing it. Check the expiration and other claims. Remember that JWT verification only proves the token was signed by the holder of the secret key — it does not encrypt the payload.

   entrada

   JWT + secret

   输出

   signature valid, not expired

Resultado esperado

Un válido, signed JWT ese puede ser verified por anyone con el signing clave.

Errores comunes

Putting sensitive data in the payload

The JWT payload is Base64-encoded, not encrypted. Anyone can decode it. Never put passwords, secrets, or PII in the payload.

Missing expiration claim

Always set an exp claim to limit the token's lifetime. Tokens without expiration are valid indefinitely, which is a security risk if compromised.

Solución de problemas指引

• If verification fails, check the algorithm, key, and that the token is not expired.
• Use HS256 for symmetric signing (shared secret) or RS256 for asymmetric (private key signs, public key verifies).

Límites de seguridad

• JWT payloads are readable by anyone. They provide integrity (tamper detection) but not confidentiality.
• This tool encodes and signs locally. Your secret key never leaves your browser.
• JWT is for local token inspection and testing, not for server-side authentication.