{"id":10338,"date":"2026-09-03T07:35:00","date_gmt":"2026-09-03T05:35:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=10338"},"modified":"2026-10-09T21:08:20","modified_gmt":"2026-10-09T19:08:20","slug":"json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/","title":{"rendered":"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying"},"content":{"rendered":"<p>Want to see what is inside a token? With a signed JWT, reading its contents is often quick. The more useful question comes next: which of those claims may an application actually rely on?<\/p>\n<p>This article covers the common signed JWS form with three parts. Its header and payload are Base64url-encoded, not encrypted. Encrypted JWTs (JWE) are a different form. We will keep reading a token separate from validating it.<\/p>\n<aside class=\"lw-article-context\" data-lw-editorial=\"20261009\">\n<p><strong>Why this topic belongs here<\/strong> My own projects include web applications and APIs. This introduction explains a distinction that can be easy to miss when working with tokens.<\/p>\n<p><strong>Trying it and putting it in context<\/strong> Use a demo token to try this out. A decoder displays fields; that does not validate a signature or access permissions. Real access tokens do not belong in public examples.<\/p>\n<\/aside>\n<figure class=\"lw-diagram\">\n<img decoding=\"async\" src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/jwt-lesen-en.png\" width=\"1120\" height=\"580\" loading=\"lazy\" alt=\"A token split into its three dot-separated parts with header and payload decoded into readable JSON, marked as readable by anyone, and the signature marked as the only part that protects anything\"><figcaption>Two of the three parts are readable by anyone. The third is the only one that protects anything.<\/figcaption><\/figure>\n<h2>The Three Parts and What Each Does<\/h2>\n<p>A token is three sections separated by dots. The first names the algorithm and, often, the key that was used. The second carries the claims &#8211; who the token is about, what it may do, how long it is valid. The third is the signature over the first two.<\/p>\n<p>Only the third part does any protecting, and it protects exactly one property: that the first two have not been changed since they were signed. It does not hide them, and it does not need to be understood in order for them to be read. A token pasted into any decoder gives up its contents immediately.<\/p>\n<h2>What Has No Business in the Payload<\/h2>\n<p>Every field in the payload is a field handed to whoever holds the token. An email address, a full name, a date of birth &#8211; these turn a credential into a data disclosure, and they end up in places that credentials reach and personal data should not: proxy logs, browser storage, error reports.<\/p>\n<p>The second category is internal structure. A list of roles like <code>billing_admin<\/code> or a tenant id says what exists behind the API and how it is organised, which is exactly what an attacker enumerates first. A short subject and a scope are usually enough; the rest belongs in the lookup the server does anyway.<\/p>\n<p>The third is anything that was only ever meant for the issuer. Tokens are copied into support tickets, and a payload that carries an internal customer number leaves with them.<\/p>\n<h2 id=\"exp-is-the-only-thing-that-ends-a-token\">Expiry and server-side rules<\/h2>\n<p><code>exp<\/code> sets an expiry time. Without it, a token is not automatically valid indefinitely: the application can require the field and check further rules.<\/p>\n<p>Deleting a token in the browser does not revoke existing copies. Earlier rejection needs a server-side strategy, such as a deny list. Validation by the receiving service matters. <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc7519.html#section-4.1.4\">RFC 7519: exp<\/a>.<\/p>\n<p>Short-lived access tokens and centrally revocable refresh tokens are one possible design. Suitable lifetimes depend on the application and its revocation strategy.<\/p>\n<h2>Where Decoding Gets Confused With Verifying<\/h2>\n<p>Reading a token and trusting it are different operations, and the difference is a library call. A decoder shows the claims of any token, including one that was written by hand three seconds ago. Verification checks the signature against a key, and only that answers whether the claims were issued by anyone entitled to issue them.<\/p>\n<p>Two failure modes follow from confusing them. The first is <code>alg: none<\/code> &#8211; a token that declares it has no signature. A verifier that reads the algorithm out of the token and obliges will accept anything; the algorithm has to be fixed by the application, not by the token. The second is the same mistake with a key: a service expecting RS256 that is handed an HS256 token can be talked into verifying it with the public key as the shared secret &#8211; and the public key is public.<\/p>\n<h2>What Belongs in Every Token<\/h2>\n<p>Three claims are worth insisting on. <code>exp<\/code>, because without it nothing ends. <code>iss<\/code>, so a service can tell which issuer a token came from rather than accepting anything that verifies. And <code>aud<\/code>, which is the one that stops a token minted for the reporting API from being accepted by the billing API &#8211; a check that is easy to skip and hard to notice missing.<\/p>\n<p>None of this needs tooling to review. Splitting a token at its dots and decoding the middle part takes seconds, and it answers the questions that otherwise get answered by assumption: how long this is valid, what it permits, and what it tells anyone who reads it.<\/p>\n<div class=\"lw-faq\">\n<h2>Questions and answers<\/h2>\n<h3>What happens to tokens already issued when the signing key is rotated?<\/h3>\n<p>They stay valid for as long as the verifier still knows the old key. The signature is checked against a key from the verifier\u2019s own list, usually the one named in the first part of the token. Once that key disappears from the list, every token signed with it fails at once, whatever its exp says.<\/p>\n<p>For a planned rotation this dictates an order. The verifiers learn the new key first, then the issuer starts signing with it, and the old key stays in place until the last token it signed has expired. With access tokens that live for minutes, the overlap is short; if refresh tokens are issued as signed tokens too, it stretches as far as their lifetime.<\/p>\n<p>Conversely, removing a key ends every token signed with it ahead of time, with no deny list at all. That is the right move when the signing key has fallen into the wrong hands, but it hits every client at once. In any case, the key reference in the token may only select among keys the verifier holds itself, for the same reason the algorithm must not come from the token.<\/p>\n<h3>Can the payload be encrypted instead of being kept short?<\/h3>\n<p>Yes, with JSON Web Encryption as defined in RFC 7516, and then only a holder of the key can read the contents. The token remains a credential all the same: a copy in a support ticket or a log file becomes unreadable but stays just as usable until exp has passed. A field the server can look up anyway therefore needs no encryption; it needs no place in the token at all.<\/p>\n<h3>What does it mean for exp when the clocks of the servers involved drift apart?<\/h3>\n<p>exp is a point in time, and it is compared against the clock of the verifying service, not the issuer\u2019s. If that clock runs behind, the service still accepts a token that has already expired. If it runs ahead, the lifetime shrinks by the offset, and for an access token that lives a few minutes, a single minute is already a noticeable share of it. For nbf, the time from which a token is valid, the offset works the other way round: a service whose clock runs behind rejects a freshly issued token as not yet valid.<\/p>\n<p>RFC 7519 allows a small leeway for this, usually no more than a few minutes, and most libraries offer a setting for it. The leeway does, however, extend every token by exactly that amount, and two minutes of leeway on an access token with a five-minute lifetime is no minor matter. The more reliable approach is to keep every machine involved synchronised via NTP and to leave the leeway at a few seconds.<\/p>\n<\/div>\n<div class=\"lw-quellen\">\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc7519.html\" target=\"_blank\" rel=\"noopener noreferrer\">RFC 7519: JSON Web Token<\/a><\/li>\n<li><a href=\"https:\/\/developers.google.com\/search\/docs\/crawling-indexing\/verifying-googlebot\" target=\"_blank\" rel=\"noopener noreferrer\">Google Search Central: verifying crawlers<\/a><\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Want to see what is inside a token? With a signed JWT, reading its contents is often quick. The more useful question comes next: which of those claims may an application actually rely on?<\/p>\n","protected":false},"author":1,"featured_media":15143,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[148],"tags":[91392,91115],"class_list":["post-10338","post","type-post","status-publish","format-standard","hentry","category-web-development","tag-rest-api","tag-web-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying | Lukas Wojcik<\/title>\n<meta name=\"description\" content=\"Base64 is not protection: what belongs in a JWT payload, why a token without exp never expires, and how alg none turns verification into reading.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying | Lukas Wojcik\" \/>\n<meta property=\"og:description\" content=\"Base64 is not protection: what belongs in a JWT payload, why a token without exp never expires, and how alg none turns verification into reading.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-03T05:35:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-09T19:08:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-10338-a-jwt-is-signed-not-encrypted-n.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Lukas Wojcik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lukas Wojcik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/\"},\"author\":{\"name\":\"Lukas Wojcik\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying\",\"datePublished\":\"2026-09-03T05:35:00+00:00\",\"dateModified\":\"2026-10-09T19:08:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/\"},\"wordCount\":1250,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-10338-a-jwt-is-signed-not-encrypted-n.png\",\"keywords\":[\"REST API\",\"Web Security\"],\"articleSection\":[\"Web Development\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/\",\"name\":\"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying | Lukas Wojcik\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-10338-a-jwt-is-signed-not-encrypted-n.png\",\"datePublished\":\"2026-09-03T05:35:00+00:00\",\"dateModified\":\"2026-10-09T19:08:20+00:00\",\"description\":\"Base64 is not protection: what belongs in a JWT payload, why a token without exp never expires, and how alg none turns verification into reading.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-10338-a-jwt-is-signed-not-encrypted-n.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-10338-a-jwt-is-signed-not-encrypted-n.png\",\"width\":1200,\"height\":630,\"caption\":\"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"Lukas Wojcik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"Lukas Wojcik\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying | Lukas Wojcik","description":"Base64 is not protection: what belongs in a JWT payload, why a token without exp never expires, and how alg none turns verification into reading.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/","og_locale":"en_US","og_type":"article","og_title":"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying | Lukas Wojcik","og_description":"Base64 is not protection: what belongs in a JWT payload, why a token without exp never expires, and how alg none turns verification into reading.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-09-03T05:35:00+00:00","article_modified_time":"2026-10-09T19:08:20+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-10338-a-jwt-is-signed-not-encrypted-n.png","type":"image\/png"}],"author":"Lukas Wojcik","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lukas Wojcik","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/"},"author":{"name":"Lukas Wojcik","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying","datePublished":"2026-09-03T05:35:00+00:00","dateModified":"2026-10-09T19:08:20+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/"},"wordCount":1250,"commentCount":0,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-10338-a-jwt-is-signed-not-encrypted-n.png","keywords":["REST API","Web Security"],"articleSection":["Web Development"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/","name":"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying | Lukas Wojcik","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-10338-a-jwt-is-signed-not-encrypted-n.png","datePublished":"2026-09-03T05:35:00+00:00","dateModified":"2026-10-09T19:08:20+00:00","description":"Base64 is not protection: what belongs in a JWT payload, why a token without exp never expires, and how alg none turns verification into reading.","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-10338-a-jwt-is-signed-not-encrypted-n.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-10338-a-jwt-is-signed-not-encrypted-n.png","width":1200,"height":630,"caption":"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/json-web-tokens-structure-what-belongs-in-the-payload-and-the-difference\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"Lukas Wojcik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"Lukas Wojcik"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/10338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=10338"}],"version-history":[{"count":4,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/10338\/revisions"}],"predecessor-version":[{"id":21722,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/10338\/revisions\/21722"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/15143"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=10338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=10338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=10338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}