MeridianMERIDIAN

JSON Web Token

technology.cryptographic.jwt

JSON Web Token (JWT) in either compact serialisation. A JWS is three base64url-encoded segments separated by dots, header.payload.signature; an unsecured JWT (RFC 7519 section 6) ends in a dot with an empty signature. A JWE (RFC 7516) is five segments (header, encrypted key, initialization vector, ciphertext and tag), where the encrypted key may be empty. Used for authentication and information exchange.

Try a value

JSON Web Token's rule accepts it.

Reads it as eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Worked samples

DuckDB 1.5.5 · finetype 0.6.66

ValueAs VARCHARheaderpayloadsignature
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5ceyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5ceyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQSflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXkeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXkeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.eyJhbGciOiJub25lIn0eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ
Standard

Shape

Pattern
^[A-Za-z0-9_-]{10,}\.(?:[A-Za-z0-9_-]{10,}\.(?:[A-Za-z0-9_-]{10,})?|[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{10,})$
ValueLengthShape
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c155matches
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIn0.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk116matches
eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.115matches
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9-eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c155rejected: separator swapped

Background

Origin

The JSON Web Token is defined by RFC 7519, published in May 2015.[1] RFC 7519 was written by M. Jones, J. Bradley and N. Sakimura.[1] RFC 7519 is an Internet Standards Track document.[1] RFC 7519 describes a JWT as a compact, URL-safe means of representing claims to be transferred between two parties.[1] RFC 7519 suggests that JWT be pronounced the same as the English word "jot".[1]

The JWS Compact Serialization is defined in RFC 7515, JSON Web Signature, as the base64url-encoded protected header, payload and signature joined by periods.[2] RFC 7515 says the compact serialization is intended for space-constrained environments such as HTTP Authorization headers and URI query parameters.[2] RFC 7515 defines base64url as Base64 encoding with the URL- and filename-safe character set, with all trailing '=' characters omitted.[2]

RFC 7519 lists seven registered claim names: iss, sub, aud, exp, nbf, iat and jti.[1] RFC 7519 recommends that a JWT's "typ" header value be "JWT".[1] RFC 7519 registers the "application/jwt" media type.[1]

Use

The OpenID Connect Core 1.0 specification says the ID Token is represented as a JSON Web Token (JWT).[3] RFC 9068 defines a profile for issuing OAuth 2.0 access tokens in JSON Web Token (JWT) format.[4] jwt.io says clients typically send a JWT in the Authorization header using the Bearer schema.[5]

jwt.io advises against putting secret information in the payload or header of a JWT unless it is encrypted.[5] jwt.io states that tokens are credentials, so great care must be taken to prevent security issues.[5]

RFC 7519 defines an Unsecured JWT as a JWS using the "alg" header parameter value "none".[1] RFC 8725, JSON Web Token Best Current Practices, warns that an attacker can change the algorithm to "none".[6] RFC 8725 says libraries must enable the caller to specify a supported set of algorithms.[6]

Sources

  1. [1]RFC 7519: JSON Web Token (JWT)standard
  2. [2]RFC 7515: JSON Web Signature (JWS)standard
  3. [3]OpenID Connect Core 1.0 incorporating errata set 2standard
  4. [4]RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokensstandard
  5. [5]JSON Web Token Introduction - jwt.iosecondary source
  6. [6]RFC 8725: JSON Web Token Best Current Practicesstandard

Detection notes

Each JWS segment, and the header, initialization vector and tag of a JWE, is at least 10 base64url chars to distinguish from other dot-separated formats. Header typically starts with "eyJ" (base64 for '{"'). Decompose reads the three JWS parts; the signature of an unsecured JWT is ''. A five-part JWE is not split (its parts are header, encrypted key, initialization vector, ciphertext and tag), so its payload and signature read ''. Discrimination counts a JWE or an unsecured JWT only when its header decodes to a JSON object with an "alg" member. An empty signature is accepted for any "alg", because logs often redact signatures, although RFC 7515 allows it only with "alg": "none".

Use it

CLI · DuckDB
$ finetype infer -i "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" --mode column
→ technology.cryptographic.jwt

SELECT ft_infer('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c');
-- → 'technology.cryptographic.jwt'
Cast expression
CAST({col} AS VARCHAR)

Schema

https://meridian.online/schemas/technology.cryptographic.jwt · Frictionless type string

finetype taxonomy technology.cryptographic.jwt -o json-schema

Aliases

json_web_token

Type Registry