All IAM glossary termsFundamentals · glossary
JSON Web Token (JWT)
Also known as: JWT · JSON Web Token
Definition
A JSON Web Token (JWT, RFC 7519) is a compact, URL-safe token format consisting of three base64url segments — header, payload, signature — used to convey claims between parties.
In more depth
A JWT looks like `xxxx.yyyy.zzzz`. The header declares the signing algorithm + key id. The payload carries claims (iss, sub, aud, exp, plus arbitrary fields). The signature proves integrity.
JWTs are widely used as OIDC ID Tokens, OAuth 2.0 access tokens (when self-contained), and inter-service auth tokens. The most common validation errors: trusting `alg=none`, skipping `iss` / `aud` checks, accepting expired tokens, or substituting algorithms (RS256 → HS256 with public key as secret).
Want the work, not just the definition?