RFC 7519¶

RFC7519 defines the JSON Web Token (JWT) specification, a compact and URL-safe format for representing claims securely between parties. JWTs are widely used for authentication, authorization, and information exchange in modern web applications and APIs.

A JWT can be digitally signed (JWS) or encrypted (JWE), enabling integrity protection, confidentiality, or both.

Definition¶

RFC 7519 specifies the structure, processing rules, and registered claim names for JSON Web Tokens. A JWT consists of three parts (for JWS) or five parts (for JWE), with a standardized set of claims to ensure interoperability across different systems.

Each JWT contains:

Header — metadata describing the token type and algorithm
Payload — a set of claims about an entity and token metadata
Signature / Authentication Tag — used to verify integrity

Registered Claim Names¶

RFC 7519 defines a set of registered claim names that have specific, interoperable meanings:

iss — Issuer: identifies the principal issuing the token
sub — Subject: identifies the principal that is the subject
aud — Audience: intended recipients of the token
exp — Expiration Time: time after which the token must not be accepted
nbf — Not Before: identifies when the token becomes valid
iat — Issued At: timestamp of issuance
jti — JWT ID: unique identifier for preventing replay attacks

These claims are optional unless required by the application.

Public and Private Claims¶

Beyond registered claims, JWT supports:

Public claims — custom claims registered in the IANA JWT Claims Registry
Private claims — application-specific claims agreed upon by communicating parties

The payload is a JSON object and can contain any key–value pairs, as long as they do not collide with registered claim names.

JWT Structure (JWS)¶

A signed JWT uses the JWS compact serialization format:

<header>.<payload>.<signature>

Each component is Base64URL-encoded. This is the most common form, used in OAuth 2.0, OpenID Connect, API tokens, and session systems.

JWT Structure (JWE)¶

An encrypted JWT uses JWE compact serialization:

<header>.<encrypted-key>.<iv>.<ciphertext>.<tag>

JWE-based JWTs provide confidentiality as well as integrity, suitable for transmitting sensitive information.

Implementation¶

All JWT features defined in RFC 7519 are implemented in joserfc.