Cybersecurity glossary
What is JSON Web Signature (JWS)?
Learn what JSON Web Signature (JWS) is, how compact signed tokens protect integrity, which algorithms are common, and how to verify JWS objects safely in JWT-based systems.
Definition
JSON Web Signature (JWS) is a JOSE standard for representing content protected by digital signatures or message authentication codes, commonly used as the signed form of JWTs with a header, payload, and signature.
Why JWS matters
APIs accept bearer tokens as proof of prior authentication. Without integrity protection, anyone can edit roles, subjects, or expiry in a readable payload. JSON Web Signature (JWS) is the JOSE mechanism that binds a cryptographic signature or MAC to that content.
In practice, “JWT authentication” usually means “verify this JWS, then authorize from claims.” Understanding JWS is therefore understanding the trust boundary of most modern token APIs.
Building blocks of a JWS
Protected header
Metadata such as alg and optional kid describing how the signature was produced.
Payload
Arbitrary content—commonly JWT claims—encoded but not encrypted by JWS alone.
Signature / MAC
Integrity proof over the encoded header and payload using the chosen algorithm.
Serialization
Compact dotted strings for HTTP, or JSON forms for multi-signature documents.
How JWS issuance and verification work
Assemble header and payload
Issuer sets algorithm metadata and the claims or content to protect.
Sign with private key or secret
Create a signature/MAC over the signing input with approved key material.
Serialize the JWS
Produce a compact token for clients to store and present.
Recipient selects verification key
Resolve kid via JWKS or local config under algorithm policy.
Verify before decode-trust
Cryptographically verify the signature; reject on mismatch or disallowed alg.
Apply application validation
Check iss, aud, time claims, and authorization attributes only after success.
Common JWS algorithm families
| Family | Examples | Operational notes |
|---|---|---|
| HMAC | HS256, HS384, HS512 | Shared secret; every verifier can also forge tokens |
| RSA | RS256, PS256 | Asymmetric; publish public JWK for many verifiers |
| Elliptic curve | ES256, ES384 | Smaller keys; bind curve and alg strictly |
| Edwards-curve | EdDSA | Modern choice where library support is mature |
Safe JWS verification checklist
- Verify signatures with maintained libraries—never hand-roll base64 and crypto glue.
- Allowlist algorithms server-side; ignore attacker-chosen alg except as a rejection signal.
- Bind key type to algorithm to prevent confusion attacks.
- Reject tokens with alg none or empty signatures for authentication use cases.
- Validate critical header parameters and constrain kid to known keys.
- Treat payload as untrusted until verification succeeds.
- Prefer asymmetric algorithms when many services must verify without sharing a forge capability.
- Monitor verification failure spikes that may indicate probing or key-distribution issues.
The practical takeaway
JWS is the signed envelope that makes JWT claims trustworthy. It does not hide those claims, and it does not authorize by itself—it only proves integrity under a chosen key and algorithm.
Verify first, allowlist algorithms, manage keys carefully, and layer claim checks on top. When confidentiality is also required, combine with JWE rather than assuming a signature provides secrecy.
Related security terms
JWT (JSON Web Token)
Claims tokens that are typically serialized as signed JWS objects.
JSON Web Encryption (JWE)
Encryption standard used when confidentiality is required beyond signing.
JSON Web Key (JWK)
Key format commonly used to publish verification material for JWS.
JWT Signature Bypass
Failures where applications accept tokens without proper JWS verification.
JWT Algorithm Confusion
Attacks that abuse incorrect algorithm or key-type binding during verify.
Frequently asked questions
What is JWS in simple terms?
JWS is a standard way to attach a cryptographic signature to data. For JWTs, that means a server can prove the header and claims were not altered after issuance.
Is every JWT a JWS?
Most common JWTs are signed using JWS. Encrypted JWTs use JWE, and unsigned tokens are not a safe authentication pattern.
What are the three parts of compact JWS?
Base64url-encoded protected header, payload, and signature, separated by periods.
Does a JWS signature encrypt the payload?
No. Signing proves integrity and authenticity. Anyone with the token can still read the payload unless encryption (JWE) or another confidentiality control is used.
What is the difference between HMAC and asymmetric JWS?
HMAC (HS*) uses a shared secret for create and verify. Asymmetric algorithms (RS*, ES*, EdDSA) sign with a private key and verify with a public key.
Can I trust claims after only base64-decoding a JWS?
Never. Decoding is not verification. Always validate the signature with an algorithm allowlist before trusting claims.
Which serialization forms exist?
Compact serialization is most common for HTTP bearers. JWS also defines JSON serializations useful for multiple signatures.
References
Explore authoritative guidance and frameworks related to json web signature (jws).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.