Web Development · Cheatsheet
JWT Reference Cheatsheet
Signed JWT claims, algorithms, verification checks, and the distinction between JWS and JWE.
37 commands 7 sections
No entry matches that filter.
-
header.payload.signatureSigned compact JWS form; encrypted JWTs use JWE and a different structure -
typUsually JWT -
algSignature algorithm in the header -
HS256HMAC SHA-256 with a shared secret -
RS256RSASSA-PKCS1-v1_5 SHA-256 -
ES256ECDSA P-256 SHA-256 -
noneUnsigned; reject this on verify
-
issIssuer -
subSubject -
audAudience -
expExpiration time (unix seconds) -
nbfNot before (unix seconds) -
iatIssued at (unix seconds) -
jtiJWT ID
-
kidKey id for key lookup -
jkuJWK set URL; treat as untrusted input -
x5uX.509 cert URL; treat as untrusted input -
x5cX.509 cert chain in the header -
ctyContent type for nested JWTs
-
Check alg allow-listDo not trust the header alg blindly -
Reject alg=noneUnsigned tokens must fail verify -
Check expReject expired tokens -
Check nbfReject tokens used too early -
Check aud and issMust match the expected values -
Decode is not verifyReading claims does not prove the signature
-
FindUtils JWT DecoderDecode header and payload in the browser -
Do not paste production secretsTreat tokens as credentials -
Look at alg firstHS256 and RS256 use different key types; none has no signature key -
Check exp as unix timeCompare to the current unix timestamp -
PEM Decoder for x5cInspect a pasted cert, not a live host
-
HS256 with a public keyAttackers can forge if verify accepts HMAC -
alg confusionLock the expected algorithm in code -
Long-lived expStolen tokens stay valid too long -
Put secrets in payloadA signed JWS payload is encoded, not encrypted; keep secrets out -
Skip audA token for another app may still verify
-
https://www.rfc-editor.org/rfc/rfc7519.htmlRFC 7519: JWT claims, signed JWS tokens, encrypted JWE tokens, and validation. -
https://www.rfc-editor.org/rfc/rfc7518.htmlRFC 7518: HMAC, RSA signatures, algorithm identifiers, and unsecured JWS.