Learning Redux

Signature

The last part of a JWT is the signature. It is created from the encoded header, the encoded payload, a secret, and the algorithm specified in the header.

The signature is used to verify that the JWT is valid. Since nobody except you (usually, the backend server) knows the secret, it is impossible to forge tokens. The signature also ensures that the claims were not modified.

Note that the secret should only be defined in the backend—you need to make sure that it never leaks. If it does, you have to set a new secret (which will invalidate all existing user sessions).

Using the HMAC SHA256 algorithm, the signature will be created as follows:

HMACSHA256(  base64UrlEncode(header) + '.' + base64UrlEncode(payload),  secret)

With our secret ...