---
title: "What are the parts of a JWT?"  
description: "What are the parts of a JWT?"  
author: "Anubhav Sharma"  
published: 2025-06-09  
updated: 2025-06-09  
canonical: https://www.mindstick.com/interview/34220/what-are-the-parts-of-a-jwt  
category: "c#"  
tags: ["c#", "authentication", "authorization"]  
reading_time: 3 minutes  

---

# What are the parts of a JWT?

A **JWT (JSON Web Token)** has **three parts**, each separated by a dot (`.`):

```plaintext
<Header>.<Payload>.<Signature>
```

### 1. Header

The header specifies the type of token and the signing algorithm used.

#### Example:

```plaintext
{
  "alg": "HS256",
  "typ": "JWT"
}
```

- `alg`: Algorithm used for signing (e.g., `HS256`, `RS256`)
- `typ`: Always `"JWT"`

This part is **Base64Url-encoded**.

### 2. Payload

The payload contains the **claims**, which are statements about the user or system.

#### Example:

```plaintext
{
  "sub": "1234567890",
  "name": "Anna Hajare",
  "admin": true,
  "iat": 1717938123,
  "exp": 1717941723
}
```

- `sub`: Subject (usually user ID)
- `iat`: Issued at timestamp
- `exp`: Expiration time (optional but recommended)
- You can add custom claims too.

> 🔓 Note: The payload is **not encrypted** — just Base64Url-encoded, so **anyone can read it**.

### 3. Signature

The signature is used to **verify** the token’s integrity and authenticity.

It's created like this:

```plaintext
HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret
)
```

If someone modifies the token, the signature check will fail.

### Example JWT

Here's a sample (fake) JWT for illustration:

```plaintext
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFubmEgSGFqYXJlIiwiaWF0IjoxNjg3ODQ2NDAwfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```

- First part = **Header**
- Second part = **Payload**
- Third part = **Signature**

## Answers

### Answer by Anubhav Sharma

A **JWT (JSON Web Token)** has **three parts**, each separated by a dot (`.`):

```plaintext
<Header>.<Payload>.<Signature>
```

### 1. Header

The header specifies the type of token and the signing algorithm used.

#### Example:

```plaintext
{
  "alg": "HS256",
  "typ": "JWT"
}
```

- `alg`: Algorithm used for signing (e.g., `HS256`, `RS256`)
- `typ`: Always `"JWT"`

This part is **Base64Url-encoded**.

### 2. Payload

The payload contains the **claims**, which are statements about the user or system.

#### Example:

```plaintext
{
  "sub": "1234567890",
  "name": "Anna Hajare",
  "admin": true,
  "iat": 1717938123,
  "exp": 1717941723
}
```

- `sub`: Subject (usually user ID)
- `iat`: Issued at timestamp
- `exp`: Expiration time (optional but recommended)
- You can add custom claims too.

> 🔓 Note: The payload is **not encrypted** — just Base64Url-encoded, so **anyone can read it**.

### 3. Signature

The signature is used to **verify** the token’s integrity and authenticity.

It's created like this:

```plaintext
HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret
)
```

If someone modifies the token, the signature check will fail.

### Example JWT

Here's a sample (fake) JWT for illustration:

```plaintext
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFubmEgSGFqYXJlIiwiaWF0IjoxNjg3ODQ2NDAwfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
```

- First part = **Header**
- Second part = **Payload**
- Third part = **Signature**


---

Original Source: https://www.mindstick.com/interview/34220/what-are-the-parts-of-a-jwt

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.