O Papel do Base64URL nos JWTs
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. To ensure JWT tokens can be safely transmitted inside HTTP headers, query parameters, or cookies without being modified or corrupted by web proxies, the token standard uses Base64URL encoding.
Standard Base64 contains + and / characters, which have special meanings in URLs. Base64URL replaces + with -, / with _, and strips trailing = padding.
As Três Partes de um JWT
JWT Structure:
Header (Base64URL) . Payload (Base64URL) . Signature (Base64URL)
Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
A Codificação Base64 NÃO é Criptografia!
A common security misconception is assuming a JWT's contents are encrypted because they look scrambled. Base64URL is simple encoding, not encryption. Anyone who captures a JWT can decode and read its header and payload instantly using our JWT Decoder Tool or Base64 Guide. Never store sensitive passwords or unencrypted secrets in a JWT payload.