Why JWT Token signing key is required

Question

JWT tokens required signing key to decode them, but in https://jwt.io/ it can be decoded without any signing key, how is this possible.

Answer 1

You do not need a key to open the encoding, you need a key to verify that nobody changed the contents of the JWT. In fact the string you see is just json's base64 with your information, metadata, and "signature" on all content.

The signature is the most important part of a JSON Web Token(JWT). A signature is calculated by encoding the header and payload using Base64url Encoding and concatenating them with a period separator. Which is then given to the cryptographic algorithm.

// signature algorithm
data = base64urlEncode( header ) + “.” + base64urlEncode( payload )
signature = HMAC-SHA256( data, secret_salt )

So when the header or payload changes, the signature has to calculated again. Only the Identity Provider(IdP) has the private key to calculate the signature which prevents the tampering of token.

read more:

https://medium.com/@sureshdsk/how-json-web-token-jwt-authentication-works-585c4f076033 https://jwt.io/introduction/

https://www.youtube.com/watch?v=7Q17ubqLfaM