Comment en Coder JWT Tokens

问题

You besoin en créer un JWT pour testing ou understanding le jeton structure utilisé en authentication.

Prérequis

• Understanding of JSON
• Knowledge of JWT structure (header.payload.signature)

Étapes

1. 1. Define the header and payload

   The header specifies the algorithm (HS256, RS256) and token type (JWT). The payload contains claims: standard (iss, sub, aud, exp, iat) and custom. Set an expiration (exp) to limit token lifetime. Do not put sensitive data in the payload — it is Base64-encoded, not encrypted.

   entrée

   header: {alg:'HS256',typ:'JWT'} | payload: {sub:'123',exp:...}

   输出

   claims defined

2. 2. Encode and sign the token

   Base64url-encode the header and payload. Compute the signature by HMAC-SHA256 (for HS256) or RSA-SHA256 (for RS256) over the encoded header.payload. Concatenate as header.payload.signature. The signature ensures the token was not tampered with.

   entrée

   header + payload + secret key

   输出

   eyJhbGciOi...eyJzdWIi...SflKxwR...

3. 3. Verify the token structure

   Decode the token and confirm the header and payload are valid JSON. Verify the signature matches by recomputing it. Check the expiration and other claims. Remember that JWT verification only proves the token was signed by the holder of the secret key — it does not encrypt the payload.

   entrée

   JWT + secret

   输出

   signature valid, not expired

Résultat attendu

Un valide, signed JWT ce peut être verified par anyone avec le signing clé.

Erreurs courantes

Putting sensitive data in the payload

The JWT payload is Base64-encoded, not encrypted. Anyone can decode it. Never put passwords, secrets, or PII in the payload.

Missing expiration claim

Always set an exp claim to limit the token's lifetime. Tokens without expiration are valid indefinitely, which is a security risk if compromised.

Dépannage指引

• If verification fails, check the algorithm, key, and that the token is not expired.
• Use HS256 for symmetric signing (shared secret) or RS256 for asymmetric (private key signs, public key verifies).

Limites de sécurité

• JWT payloads are readable by anyone. They provide integrity (tamper detection) but not confidentiality.
• This tool encodes and signs locally. Your secret key never leaves your browser.
• JWT is for local token inspection and testing, not for server-side authentication.