JWT (JSON Web Token) Cheatsheet

A quick reference for JWT structure, standard claims, signing algorithms, and common header fields.

Updated Apr 11, 2026

Sections

JWT Structure
Registered Claims (RFC 7519)
Signing Algorithms
Standard Header Fields
Validation Checklist

JWT Structure

Part	Encoding	Contains
`Header`	Base64url	Algorithm (alg) and token type (typ)
`Payload`	Base64url	Claims — registered, public, or private
`Signature`	Binary → Base64url	HMAC or RSA/ECDSA signature over header.payload

Registered Claims (RFC 7519)

Claim	Full Name	Description
`iss`	Issuer	Who issued the token — e.g. "auth.example.com"
`sub`	Subject	Who the token is about — e.g. a user ID
`aud`	Audience	Intended recipient(s) of the token
`exp`	Expiration Time	Unix timestamp — reject token after this time
`nbf`	Not Before	Unix timestamp — reject token before this time
`iat`	Issued At	Unix timestamp when the token was issued
`jti`	JWT ID	Unique identifier — used to prevent replay attacks

Signing Algorithms

Algorithm	Type	Use Case
`HS256`	HMAC-SHA256 (symmetric)	Shared secret between issuer and verifier. Simple, fast.
`HS384`	HMAC-SHA384 (symmetric)	Stronger HMAC variant.
`HS512`	HMAC-SHA512 (symmetric)	Strongest HMAC variant.
`RS256`	RSA-SHA256 (asymmetric)	Private key signs, public key verifies. Use when multiple services verify.
`ES256`	ECDSA-SHA256 (asymmetric)	Smaller keys than RSA with equivalent security.
`none`	No signature	Unsecured JWT — NEVER use in production.

Standard Header Fields

Field	Description
`alg`	Signing algorithm — e.g. "HS256", "RS256"
`typ`	Token type — always "JWT" for standard JWTs
`kid`	Key ID — hints which key to use for verification (used with JWKS)
`cty`	Content type — used when the payload is itself a JWT (nested JWT)

Validation Checklist

Check	Why
`Verify signature`	Ensures the token was not tampered with. Skipping this is a critical security bug.
`Check exp`	Reject expired tokens.
`Check nbf`	Reject tokens not yet valid.
`Check iss`	Ensure the token was issued by the expected party.
`Check aud`	Ensure the token is intended for your service.
`Use HTTPS only`	Never transmit JWTs over plain HTTP.
`Reject alg: none`	The "none" algorithm disables signature verification — always explicitly allowlist algorithms.

How to Parse a JWT

A practical guide to reading and decoding JSON Web Tokens — understand the three-part structure, decode the header and payload, and know what to check before trusting a token.

Read guide →