JWS (JSON Web Signature, RFC 7515) is the specification defining how JWTs and other JSON structures are signed. When people say “JWT” in casual conversation, they almost always mean a signed JWT — that is, a JWS.
Structure
A JWS is exactly three base64url-encoded parts joined with dots:
{header}.{payload}.{signature}The signature is computed over {header}.{payload} using the algorithm named in the header’s alg field.
Algorithms
alg | Description |
|---|---|
HS256 | HMAC with SHA-256 (symmetric — sender + receiver share the secret) |
HS512 | HMAC with SHA-512 |
RS256 | RSA signature with SHA-256 (asymmetric) |
RS512 | RSA with SHA-512 |
ES256 | ECDSA with P-256 curve and SHA-256 |
ES512 | ECDSA with P-521 and SHA-512 |
EdDSA | Edwards-curve signature (Ed25519) |
none | No signature — do not accept this |
Compact vs JSON Serialization
- Compact form — the three-dot format used in URLs and headers. What everyone means by “JWT”.
- JSON form — a structured JSON object with the signature separately. Rarely used.
Common Miss
Using symmetric algorithms (HS256) when the receiver needs to validate without also being able to produce tokens. Symmetric key = anyone with the key can sign. Use RSA or ECDSA for asymmetric verification.
Inspect a JWS’s header, payload, and signature format with the JWT decoder.
Related
Check the JWT glossary entry, the JWK glossary entry, and read the What Is a JWT? deep dive.