JWT structure
What this is
A compact JWS is header.payload.signature. Header and payload are JSON, then base64url without padding. The signature is computed over ASCII(header) + '.' + ASCII(payload). Decoding is not verifying — anyone can produce two JSON blobs.
FAQ
- Why base64url not base64?
- Tokens travel in query strings and headers. + / = break URLs. base64url uses - _ and omits padding.