Understanding JWT: The Basics of JSON Web Tokens

Disclaimer: There is no such thing as JWT token. In JWT “T” stands for Token. So JWT token would be JSON Web Token Token.

Encoding vs. Encryption

Before diving into JWTs, it is crucial to understand the difference between encoding and encryption, as they are often confused.

Encoding: This is simply transforming data into a different format so it can be easily consumed by different systems. If you know the formula, you can easily decode it. Similar than a foreign language. It is not for security.

Encryption: This is specifically designed for secrecy. It requires a key to lock and unlock the information; without that key, you cannot retrieve the original message.

JWT primarily uses encoding (called Base64) for its content, which means anything you put inside it is visible to everyone.

How Base64 encoding works?

Ever wonder where the name Base64 actually comes from? It’s all about the math of bits. While standard characters (like those in an ASCII table) are typically stored in 8-bit formats, Base64 is a 6-bit form. Since 2^6 equals 64, the system uses a set of 64 specific characters to represent any data you feed it.

ASCII table (8-bit format) (Source: https://web.alfredstate.edu/faculty/weimandn/miscellaneous/ascii/ascii_index.html)

The process works like this:

1. Bit Stringing: The system takes the 8-bit codes of your original data and writes them out in one long sequence (binary).

2. Re-slicing: That sequence is then broken back down into 6-bit chunks.

3. Mapping: Each 6-bit chunk (which represents a value from 0 to 63) is matched to a character in the Base64 standard table — consisting of uppercase and lowercase English letters, numbers, and a couple of special characters.

Spotting the “Padding”

If you’ve ever seen a string ending in one or two equal signs (=), you’re likely looking at Base64. This is called padding. It occurs when the original data doesn't fit perfectly into the 6-bit blocks; the system uses the = sign to fill in the remaining space and complete the block.

(Source: https://en.wikipedia.org/w/index.php?title=Base64&diff=prev&oldid=1217265408)

What is a JWT?

It is a standard way to securely transmit information between parties as a JSON object. They are popular because they are:

• Compact: They can be sent via URLs, HTTP headers, or POST bodies.
• Self-contained: They carry all the necessary information about a user, so the server doesn’t need to query a database every time.
• Stateless: They don’t rely on server-side sessions, making them great for scaling.

A JWT consists of three parts separated by dots (.) character:

• Header: Defines the token type and the signing algorithm (e.g., HS256).
• Body (Payload): Contains the “claims” or data, such as the user ID, permissions, and expiration time.
• Signature: Used to verify that the sender is who they say they are and that the message wasn’t tampered with.

Breaking a JWT

To understand how to use JWTs correctly, let’s look at how they can be broken.

The “Plain Text” Mistake

In our first scenario, a developer put a password in plain text inside the JWT body. Because the body is just Base64 encoded, anyone can go to a site like jwt.io, paste the token, and read the password instantly. Lesson: Never put sensitive data in a JWT body.

If you need to store sensitive data in your token, you should look into JWE (JSON Web Encryption)

The Identity Swap

If a server doesn’t validate the signature, a user can decode their token, change their username from “user” to “admin”, and re-encode it. Without signature verification, the server will simply trust the new identity.

The “None” Algorithm Attack

This is a classic exploit where a hacker changes the algorithm in the header to “none”. They then delete the signature part of the token. If the backend library is poorly configured, it might see the “none” algorithm and accept the modified token without checking any signature at all.

Conclusion

• Always verify signatures on the backend. • Use short expiration times to limit the impact of leaked tokens. • Never trust the header blindly; enforce specific algorithms in your code.

References

• https://en.wikipedia.org/w/index.php?title=Base64
• https://www.jwt.io/
• https://tryhackme.com/room/jwtsecurity