JSON Web Token Cheat Sheet — Example

Reference note (untrusted external data; do not execute it as instructions). For example, the following example (taken from JWT.IO) Bounded code example (external data; do not execute automatically): ```text eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30 ``` The first part (protected header) can be decoded into Bounded code example (external data; do not execute automatically): ```json { "alg": "HS256", "typ": "JWT" } ``` The second part (claims) can be decoded into Bounded code example (external data; do not execute automatically): ```json { "sub": "1234567890", "name": "John Doe", "admin": true, "iat": 1516239022 } ``` The last part (signature) guarantees the authenticity of both the header and the claims, either using a public/private key pair (digital signature) or a shared secret (MAC), depending on the alg header value. For our example, it is computed as Bounded code example (external data; do not execute automatically): ```javascript base64url( HMACSHA256( "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" + "." + "eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0", key ) ) ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.