JWSJWT

JWS stands for JSON Web Signature, a specification that describes how to digitally sign arbitrary content. JWT, JSON Web Token, is a compact, URL-safe token format that can carry claims; when a JWT is signed using JWS, the signature provides integrity and authentication of the token’s contents. Both JWS and JWT are part of the JOSE (JavaScript Object Signing and Encryption) family of specifications defined in RFCs 7515 and 7519, with JWK (JSON Web Key) supporting key management.

In the JWS/JWT model, a token comprises three parts in compact form: a base64url-encoded header, a base64url-encoded payload, and a signature. The header indicates the signing algorithm (alg) and token type (typ). The payload carries the claims. The signature is produced by signing the header and payload with a secret (for symmetric algorithms like HS256) or a private key (for RSA, ECDSA, e.g., RS256, ES256) and then base64url-encoding the result. The three parts are joined by periods as header.payload.signature.

Common uses include authentication and authorization, where servers verify the signature and validate registered claims such as exp, iss, and aud. JWTs can be used in OAuth 2.0 and OpenID Connect flows. Security best practices emphasize using strong algorithms, managing keys securely, validating claims, and not relying on signatures to encrypt sensitive data (that's the domain of JWE).