To understand how a JWT works, we should understand what it is first. In short, a JWT is a string of a hashed JSON object composed of a header, a payload, and a signature. A JWT is generated with the following format:
header.payload.signature
The header typically consists of two parts: type and algorithm. The type is JWT, and the algorithm can be HMAC, SHA256, or RSA, which is a hashing algorithm that uses a secret key to sign the token, for example:
{
"typ": "JWT",
"alg": "HS256"
}
The payload is the part where the information (or claims) is stored inside a JWT, for example:
{
"userId": "b08f86af-35da-48f2-8fab-cef3904660bd",
"name": "Jane Doe"
}
In this example, we only include two claims in the payload. You can put as many claims as you like. The more claims you include, the bigger the JWT size, which may affect performance. There are other optional claims, such as iss ...
