为何JWT令牌的Header和Payload总是以eyJ开头？

Great question! Let's break this down clearly so you understand exactly what's going on.

First, a quick recap: JWTs are split into three dot-separated parts: Header, Payload, and Signature. The first two parts aren't stored as plain JSON—they're encoded using Base64URL (a URL-safe variant of standard Base64).

Here's the key reason for the eyJ prefix:

• Standard JWT Headers are always JSON objects that start with {" (e.g., {"alg": "HS256", "typ": "JWT"}).
• Standard JWT Payloads are also JSON objects, so they almost always start with {" too (e.g., {"sub": "1234567890", "name": "John Doe"}).

When you Base64URL-encode the string {", you get eyJ—that's the exact prefix you're seeing.

It's worth noting that this isn't a mandatory rule in the JWT spec, but in practice, every valid, standard-compliant JWT will have this prefix. The only way you wouldn't see eyJ is if someone created a non-standard JWT with a non-JSON Header/Payload—which is extremely rare and defeats the purpose of using JWT in the first place.

To wrap it up:

• eyJ is the Base64URL-encoded version of {"
• Since JWT Header/Payload are JSON objects starting with {", their encoded forms start with eyJ

内容的提问来源于stack exchange，提问作者Suresh Prajapati