What is the proper format/ notation for JSON Web Tokens?

Tom

11/23/23, 3:48 PM

A JSON Web Token is supposed to have the following format:

token = encodeBase64(header) + '.' + encodeBase64(payload) + '.' + encodeBase64(signature)

When I use the jsonwebtoken node.js function to create a token:

jsonwebtoken.sign({username : "admin", password : "admin"}, publicKey, { algorithm:'HS256' });

It produces the following output:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbiIsImlhdCI6MTY2OTIxMDE0MH0.Cj2-vgNkw2xChXMe5YjIrH9UYH6-pL7ArSERBVJO-zE

When you decode the header, you get:

'{"alg":"HS256","typ":"JWT"}'

But decoding the payload gives a padding error because the padding has been omitted. Only when the payload is changed to (correct number of '=' added):

eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbiIsImlhdCI6MTY2OTIxMDE0MH0=

Does it decode correctly to:

'{"username":"admin","password":"admin","iat":1669210140}'

And the signature cannot be decoded because it contains multiple '-', which is an invalid base64 character.

My question is this:

If each section is meant to be base64 encoded, then why is the padding ommitted from the payload, and what is the strange syntax of the signature?

I tried finding information on the jsonwebtoken GitHub repository , but couldn't find an explanation.

EDIT: After doing some more research, I discovered that JWT uses Base64URL encoding, not Base64 encoding. Will update this post once I have more information.

1 + 0

jwt

Score:0

Crypto

user105214

11/23/23, 7:24 PM

JWTs are not encoded in plain Base64, but in Base64url. For this version, padding is optional, and it uses different charset: '-' instead of '+' and '_' instead of '/'.

Sources:

https://jwt.io/introduction https://en.wikipedia.org/wiki/Base64#Variants_summary_table

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: What is the proper format/ notation for JSON Web Tokens?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.