JWT is primarily used for:

• Authentication
• Authorization

JWT normally uses:

Digital Signatures

NOT encryption.

JWT stands for:

JSON Web Token

Structure:

Header.Payload.Signature

Example:

xxxxx.yyyyy.zzzzz

Contains metadata.

Example:

{
  "alg": "HS256",
  "typ": "JWT"
}

Meaning:

• JWT token
• Uses HS256 algorithm

Contains claims.

Example:

{
  "userId": 123,
  "role": "admin"
}

Common claims:

• sub
• exp
• iss
• aud
• iat

Protects token integrity.

Conceptually:

Header + Payload
       ↓
      Sign
       ↓
   Signature

Purpose:

• Detect modification
• Verify issuer

User logs in.

Email + Password

Server validates credentials.

Server creates JWT.

Header
Payload
Signature

Server returns token.

{
  "token": "eyJhbGciOi..."
}

Client stores token.

Possible locations:

• Cookie
• Local Storage
• Memory

Client calls protected API.

Authorization: Bearer <token>

Server verifies token signature.

If valid:

Access Granted

If invalid:

401 Unauthorized

HS256

Uses:

ONE SECRET KEY

Secret Key
    |
    +--> Sign JWT
    |
    +--> Verify JWT

JWT_SECRET=abc123

Signing:

Sign(token, abc123)

Verification:

Verify(token, abc123)

• Simple
• Fast
• Easy setup

All services need the same secret key.

If the secret leaks:

Anyone can generate valid JWTs.

RS256

Uses:

PUBLIC KEY + PRIVATE KEY

Private Key → Sign JWT

Public Key  → Verify JWT

JWT_PRIVATE_KEY=/keys/private.pem

JWT_PUBLIC_KEY=/keys/public.pem

Sign(token, Private Key)

Only owner can sign.

Verify(token, Public Key)

Anyone with public key can verify.

• Better for microservices
• Private key remains isolated
• Public key can be distributed safely

• More complex
• Slightly slower

JWT_SECRET=my-secret-key

or

JWT_KEY=my-secret-key

This usually means:

HS256

Uses:

1 Secret Key

JWT_PRIVATE_KEY=/keys/private.pem

JWT_PUBLIC_KEY=/keys/public.pem

This usually means:

RS256

Uses:

2 Keys

JWT is usually:

SIGNED

JWT is usually NOT:

ENCRYPTED

Anyone can decode payload contents.

Example:

{
  "userId": 123,
  "role": "admin"
}

Therefore do NOT store:

• Passwords
• API Secrets
• Credit Card Numbers
• Sensitive Personal Information

inside JWT payloads.

Cryptography
│
├── Encryption
│   │
│   ├── Symmetric (1 Key)
│   │   └── AES
│   │
│   └── Asymmetric (2 Keys)
│       └── RSA Encryption
│
└── Digital Signatures
    │
    ├── Symmetric Signature
    │   └── HS256 JWT
    │
    └── Asymmetric Signature
        └── RS256 JWT

Memory Trick:

Encryption
= Hide Data

Signature
= Verify Data

HS256
= 1 Secret Key

RS256
= Private Key + Public Key

JWT
= Usually Signed
= Usually Not Encrypted