Le rôle de Base64URL dans les JWT
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. To ensure JWT tokens can be safely transmitted inside HTTP headers, query parameters, or cookies without being modified or corrupted by web proxies, the token standard uses Base64URL encoding.
Standard Base64 contains + and / characters, which have special meanings in URLs. Base64URL replaces + with -, / with _, and strips trailing = padding.
Les trois parties d'un JWT
JWT Structure:
Header (Base64URL) . Payload (Base64URL) . Signature (Base64URL)
Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
L'encodage Base64 n'est PAS un chiffrement !
A common security misconception is assuming a JWT's contents are encrypted because they look scrambled. Base64URL is simple encoding, not encryption. Anyone who captures a JWT can decode and read its header and payload instantly using our JWT Decoder Tool or Base64 Guide. Never store sensitive passwords or unencrypted secrets in a JWT payload.