JSON Web Token (JWT)
A JSON Web Token (JWT) is a compact, JSON-based data structure used for securely transmitting information between parties as a JSON object
1. It is commonly used in authentication and authorization flows, such as being included in a redirect URI after a user completes an OAuth login process
1.
Structure of a JWT
A JWT consists of three distinct parts separated by dots (.):
- Header: Contains metadata about the token, typically including the type of token (JWT) and the signing algorithm used, such as RS256 (RSA + SHA-256) 1. It also includes a Key ID (
kid) to identify which public key should be used for verification 1.
- Payload: Contains "claims," which are name-value pairs of data 1. These claims can include user identifiers or other relevant session information 1.
- Signature: Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way 1. The signature is typically verified against the combined header and payload using a JSON Web Key (JWK) 1.
Role in Web2 and Web3
JWTs serve as a bridge for authentication across different digital ecosystems:
- Authentication Tool: Developers can integrate identity solutions into both Web2 and Web3 applications using SDKs that utilize these tokens for secure access .
- Identity Verification: In decentralized protocols like Sui's zkLogin, JWTs are used to derive user addresses and verify identities against public keys retrieved from providers like Google 1.
- Interoperability: Because JSON is a lightweight, text-only format, JWTs can be easily exchanged between browsers and servers and used by any programming language 3.