The definition for JSON Web Tokens (JWT, see RFC 7519) says that it is a "URL-safe means of representing claims to be transferred between two parties".

I'm wondering, what does it mean if something is URL-safe? As far as I know, JWT are not passed around as part of the URL. Is it just that, or is there more to it?

CodePudding user response：

Later in the RFC it says:

A JWT is represented as a sequence of URL-safe parts separated by period ('.') characters. Each part contains a base64url-encoded value.

This, combined with the RFC not specifying some other meaning explicitly, suggests it means simply "safe to put in a URL" (e.g., doesn't have unencoded / or ? or & characters, etc.).