What the signature covers
01In the default compact form, signing covers the encoded protected header, a dot, and the encoded payload.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 5.1 ↗
RFC 7515 · § 5.1EXAMPLE
3 / 3
03
Sign or MAC
Compute the protected value using the selected appropriate key.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 7515 default payload encodingRFC 7797 § 3
An optional b64:false extension allows unencoded payloads with explicit critical-header handling. RFC 7797 prohibits this option for JWTs.
Read the updated RFC section ↗Base64url encoding does not hide the payload.
- Base64url encoding does not hide the payload.
- The signing input is bytes, not a reserialized interpretation of JSON.
- The third compact part is the signature or MAC value.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy