Encoded Token
Header
Algorithm & Token Type
Payload
Data Claims
Signature
HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), your-256-bit-secret)