JWT Header & Payload Debugger

Understanding JSON Web Token (RFC 7519) Anatomy

A JSON Web Token (JWT) consists of three Base64URL-encoded strings separated by dot (.) delimiters:

• Header: Specifies the cryptographic signing algorithm (e.g., HS256, RS256) and token type.
• Payload: Contains statement claims including issuer (iss), expiration (exp), subject (sub), and custom roles.
• Signature: Generated by computing the cryptographic hash over the Header and Payload using a secret key or private key.

Mitigating the 'alg: none' Authentication Vulnerability

A notorious vulnerability in early JWT libraries allowed attackers to modify the header algorithm to "alg": "none" and strip the signature entirely. Vulnerable backend parsers accepted unsigned tokens, elevating privileges to administrator accounts. Modern API gateways must strictly enforce algorithm whitelisting during signature verification.