title: Explanations on JWT Tokens structure
body: <p>I'm trying to understand JWT tokens usage but I'm getting lost on the theorycal part.</p>
  <p>I have some questions about JWT Tokens structure, in order to make this question a sort of documentation for new users, providing it with a logic order, I will write them <strong>in bold</strong> below as long as I list a sample JWT content.</p>
  <p>I will also summary them in the end of the question</p>
  <hr />
  <p>A &quot;classic&quot; JWT token is composed as follows:</p>
  <p>[HEADER].[PAYLOAD].[SIGNATURE]</p>
  <p>In detail:</p>
  <hr />
  <p><strong>HEADER</strong></p>
  <pre><code>{
    &quot;alg&quot;: &quot;HS256&quot;,
    &quot;typ&quot;: &quot;JWT&quot;
  }
  </code></pre>
  <p>Which contains the following fields:</p>
  <ul>
  <li>ALG = Encryption algorythm (using the default HS256 could be fine)</li>
  <li>TYP = simply tells that it's a JWT</li>
  </ul>
  <hr />
  <p><strong>PAYLOAD</strong></p>
  <pre><code>{
    &quot;sub&quot;: &quot;1234567890&quot;,
    &quot;name&quot;: &quot;MrJohnDoe&quot;,
    &quot;iat&quot;: 1516239022
  }
  </code></pre>
  <ul>
  <li>SUB = Is an OPTIONAL parameter. It's the subject of the token. (credits: see @cassiomolin answer)</li>
  </ul>
  <p>According to: <a href="https://stackoverflow.com/questions/32152574/where-to-store-user-id-in-jwt">Where to store user id in jwt</a>, it looks like you can use it to store your user ID in it.</p>
  <ul>
  <li>NAME = The username</li>
  <li>IAT = Token creation date and time, expressed in unix timestamp. (Thanks to @jps and @JeanRostan in the comments below)</li>
  </ul>
  <hr />
  <p><strong>SIGNATURE</strong></p>
  <pre><code>HMACSHA256(
    base64UrlEncode(header) + &quot;.&quot; +
    base64UrlEncode(payload),
    
  secret
  
  )
  </code></pre>
  <ul>
  <li>SECRET = Unique key known just by the server. To not confuse with the current user password, which should never be used for this! (thanks to @jps in the comments below)</li>
  </ul>