JSON Web Signature (JWS)

JSON Web Signature (JWS) is the IETF standard (RFC 7515) for signing or authenticating data with JSON, underlying most JSON Web Tokens.

JSON Web Signature (JWS) is a standard, defined by the IETF in RFC 7515, for representing data that has been signed or authenticated with a Message Authentication Code (MAC), using JSON as the underlying format. It packages a header describing the signing algorithm, a payload of arbitrary data, and the resulting signature or MAC value into a single structure that travels easily inside a URL, an HTTP header or a JSON Web Token.

The most common shape is the compact serialization: three base64url-encoded segments - header, payload and signature - joined by dots into one text string. A less common JSON serialization allows several signatures over the same payload, which suits cases where more than one party must sign the same data.

JWS says nothing about the meaning of the payload; it only protects it. That neutrality is why it underlies so much of modern web authentication: a signed JSON Web Token is, technically, a JWS whose payload happens to be a set of claims, and protocols such as OpenID Connect rely on that signature to let a relying party trust who issued the token.

Note: JWS proves the data has not changed since signing and, with an asymmetric algorithm, who signed it - but a JWS on its own carries no qualified certificate and no QSCD, so it is not a qualified electronic signature under eIDAS. For that, formats such as JAdES add the missing certificate and validation data on top of the same JWS mechanism.