API › Module 4 › Lesson 1
JWT Structure: Header Payload Signature
Three Base64url parts — decode lab JWTs on 127.0.0.1:8813 only.
Visual · jwt_structure
header.payload.signature. 127.0.0.1:8813.
Opening
A JWT is not encrypted by default. It is encoded and signed — readable to anyone who holds it.
JSON Web Tokens usually look like three dot-separated Base64url segments: header, payload, signature. The payload claims are visible unless you also encrypt (JWE — different tool). Defenders must stop treating JWTs like opaque vaults. Original Cyberlium Module 4. Decode lab tokens from 127.0.0.1:8813. You will NOT steal JWTs from stranger apps, not forge tokens against production, not phish for id_tokens. Next: alg=none and Signature Verify.
1. Readable claims are a feature and a risk
Anyone with the token can read claims like sub, role, exp unless encrypted. Do not put passwords or raw PANs in JWT payloads.
On YOUR lab, base64url-decode the payload (pad carefully) and list claims. That is literacy, not an attack on someone else’s session.
Command guide
Try these commands — Readable claims are a feature and a risk
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
RFC 7519 JWT — https://www.rfc-editor.org/rfc/rfc7519 jwt.io — https://jwt.io/ (decode literacy — YOUR lab tokens only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install jq
macOS:
Command — copy this
brew install python3 brew install jq
Windows: Download https://python.org/downloads/
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
python3 - <<'PY'
import base64, json
tok='eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJsYWItdXNlciIsInJvbGUiOiJ1c2VyIn0.x'
h,p,_=tok.split('.'); pad=lambda s:s+'='*(-len(s)%4)
print('header', json.loads(base64.urlsafe_b64decode(pad(h))))
print('payload', json.loads(base64.urlsafe_b64decode(pad(p))))
PYCommand — copy this
echo 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJsYWIifQ.sig' | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | jq . || true
Primary tools to practice this lesson: python3, jq. Reference sites: RFC 7519 JWT (https://www.rfc-editor.org/rfc/rfc7519); jwt.io (https://jwt.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Signature is the integrity gate
Without a verified signature, the payload is fan fiction. Libraries must verify with the right key and algorithm — Module 4 lesson 2.
Write: encode ≠ encrypt; signature ≠ secrecy. Keep that sentence for the quiz.
3. Ethics
Paste only lab JWTs into decoders. Do not drop customer tokens into public jwt.io sessions without redaction policy — prefer local decode for class.
Ship a diagram note: three parts, names, and “payload is readable.”
4. What you ship: a three-part JWT map and a decoded lab payload
Named header/payload/signature. Decoded lab claims. encode≠encrypt sentence. Dest 127.0.0.1:8813. No stranger token dumping.
5. What you record before the next lesson
Date. Claim list from lab JWT. File t13-m04-l01-jwt-structure.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
Paste production user JWTs into a public decoder. Assume JWT means ciphertext. Forge tokens for a SaaS.
Right
Lab decode only. Next: alg=none and Signature Verify.
Mission: see inside a lab JWT safely
1) / STOP if router. 2) Obtain a lab JWT from 127.0.0.1:8813. 3) Decode payload locally; write encode≠encrypt. Never forge against unowned APIs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for local base64url decode tips — not for cracking HS256 with wordlists against live apps.
Knowledge Check
APPLY: True or False: A normal signed JWT encrypts its claims by default.
True or False
Knowledge Check
APPLY: Three JWT parts are:
Multiple choice
Knowledge Check
APPLY: Module 4 teaching port?
Multiple choice