title: Why is the signature part of a jwt token always different, even when created with the same values?
body: <p><a href="https://www.npmjs.com/package/jsonwebtoken" rel="nofollow noreferrer">jsonwebtoken</a>, v8.5.0<br />
  node v10.13.0<br />
  npm 6.4.1</p>
  <p>If i create a token several times with:</p>
  <pre><code>jwt.sign({ user_email: user_email, user_id: user_id, username: username }, 'RESTFULAPIs')  
  </code></pre>
  <hr />
  <p><em>Question 01:</em></p>
  <p>It seems the first 2 parts of the string are always the same (the base64 encoded <code>header</code> and <code>payload</code> values), but the third part (the <code>signature</code>) is different.</p>
  <p>Why is the <code>signature</code> different when the original values are the same?</p>
  <p><em>What I've Tried:</em></p>
  <p>I have read the <code>signature</code> section at <a href="https://jwt.io/introduction/" rel="nofollow noreferrer">jwt.io/introduction</a>:</p>
  <blockquote>
  <p>To create the signature part you have to take:</p>
  <ul>
  <li>the encoded header</li>
  <li>the encoded payload</li>
  <li>a secret</li>
  <li>the algorithm specified in the header</li>
  </ul>
  <p>and sign that.</p>
  </blockquote>
  <p>So, as a guess:</p>
  <p>Is the <code>signature</code> the result of encrypting the base64 encoded <code>header</code> and <code>payload</code> values using the <code>HS256</code> algorithm and <code>secret</code>, which in this case is the string <code>RESTFULAPIs</code>, which produces a different <em>result</em> each time it is encrypted, whilst the decoded result is always the same?</p>
  <hr />
  <p><em>Question 02:</em></p>
  <p>The decoded value of the different tokens is always the same, except for an object property called <code>iat</code>.  What does that property represent?</p>
  <pre class="lang-js prettyprint-override"><code>{
  iat: 1561358034
  user_id: &quot;25423537fshsdgA&quot;
  user_email: &quot;info@test.com&quot;
  username: &quot;bob&quot;
  }
  
  {
  iat: 1561358156
  user_id: &quot;25423537fshsdgA&quot;
  user_email: &quot;info@test.com&quot;
  username: &quot;bob&quot;
  }
  
  </code></pre>
  <p>Actually, after researching this second question more, I came across this:</p>
  <blockquote>
  <p>The &quot;iat&quot; (issued at) claim identifies the time at which the JWT was
  issued. This claim can be used to determine the age of the JWT. Its
  value MUST be a number containing a NumericDate value.</p>
  </blockquote>
  <p>Source:  <a href="https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6</a></p>