title: What is a secret key in JWT
body: <p>I am unable to clearly grasp how <code>JWT</code> works, esp. the signature part.</p>
  
  <p>Once a client submits correct username and password, the authentication server creates a <code>JWT</code> token consisting of header, payload/claims and signature. </p>
  
  <p>Question 1 - Is signature some secret key (not the user's password) which only the authentication server knows (sort of a private key of the server)?</p>
  
  <p>Question 2 - Say I am using a separate application server and authentication server, on receiving  <code>JWT</code> from client, would the application server send the <code>JWT</code> to authentication server to get it validated? I suppose the application server cannot validate a <code>JWT</code> token as it doesn't know the secret key used to sign the header and payload.</p>
  
  <p>Question 3 - I took the following <code>JWT</code> and pasted it on <code>jwt.io</code>. I see the message <code>Signature Verified</code>. How does jwt.io know that the signature is correct as it doesn't know the secret key.</p>
  
  <p><code>eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxLS9tSjVsVTNYc09QWCt2VitpaGZRMWlCUDVjUTROQm1hNDluOE9rS1FFSnEzTDFNOTl2VW9iQ1ZLUHVYMmdlWWhYaHJQM0t3bHY4SE1RaHNGdnFjbllIeGxGSHM9IiwiaXNzIjoicGxheS1zaWxob3VldHRlIiwiZXhwIjoxNTI2MjgxMDU1LCJpYXQiOjE1MjYyMzc4NTUsImp0aSI6IjhmOGM3YTVmYWRkNTE5MjUxNzQ5NGE4N2Q1ODcxZjJjZGUxZDkzMDdkOTY1MThjNjg2NzExOTc1YjU3M2I5NDBlZWU2NGY0NDUwYzcxODI3NGZmNzU1MmE2Y2JlNTVmZmZhMWI1ZjA3ZWZlOWVkNTE0Y2Y4YTViOTZlM2ExYjI0ODRmYTI5NjZiYjA0ODlmODIwZjMyMzM5YWVhNjM3NWRkZmU4ZDE4N2E2NzBjMzg0ODgwZGIyMzQ1ZTFkMzRkYWNjZmY2MTdkMDY1NzU3YmEwZTQzNDg4YWFhZmZmNDNjYWZlZGY0OTFlODU1YTA0NWM0NmJjNDY4NGYzODlmY2YifQ.GwN6TSNd426xpc3Y02eRXHbrmSr_61MMBqrmx66Ofqs</code></p>
  
  <p><a href="https://i.stack.imgur.com/EhUmJ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/EhUmJ.png" alt="enter image description here"></a></p>