JWT Reference
Signed JWT claims, algorithms, verification checks, and the distinction between JWS and JWE.
Shape
7 entries| Syntax | Description |
|---|---|
header.payload.signature | Signed compact JWS form; encrypted JWTs use JWE and a different structure |
typ | Usually JWT |
alg | Signature algorithm in the header |
HS256 | HMAC SHA-256 with a shared secret |
RS256 | RSASSA-PKCS1-v1_5 SHA-256 |
ES256 | ECDSA P-256 SHA-256 |
none | Unsigned; reject this on verify |
Registered claims
7 entries| Syntax | Description |
|---|---|
iss | Issuer |
sub | Subject |
aud | Audience |
exp | Expiration time (unix seconds) |
nbf | Not before (unix seconds) |
iat | Issued at (unix seconds) |
jti | JWT ID |
Header flags
5 entries| Syntax | Description |
|---|---|
kid | Key id for key lookup |
jku | JWK set URL; treat as untrusted input |
x5u | X.509 cert URL; treat as untrusted input |
x5c | X.509 cert chain in the header |
cty | Content type for nested JWTs |
Verify rules
6 entries| Syntax | Description |
|---|---|
Check alg allow-list | Do not trust the header alg blindly |
Reject alg=none | Unsigned tokens must fail verify |
Check exp | Reject expired tokens |
Check nbf | Reject tokens used too early |
Check aud and iss | Must match the expected values |
Decode is not verify | Reading claims does not prove the signature |
Inspect locally
5 entries| Syntax | Description |
|---|---|
FindUtils JWT Decoder | Decode header and payload in the browser |
Do not paste production secrets | Treat tokens as credentials |
Look at alg first | HS256 and RS256 use different key types; none has no signature key |
Check exp as unix time | Compare to the current unix timestamp |
PEM Decoder for x5c | Inspect a pasted cert, not a live host |
Common mistakes
5 entries| Syntax | Description |
|---|---|
HS256 with a public key | Attackers can forge if verify accepts HMAC |
alg confusion | Lock the expected algorithm in code |
Long-lived exp | Stolen tokens stay valid too long |
Put secrets in payload | A signed JWS payload is encoded, not encrypted; keep secrets out |
Skip aud | A token for another app may still verify |
Sources
2 entries| Syntax | Description |
|---|---|
| RFC 7519: JWT claims, signed JWS tokens, encrypted JWE tokens, and validation. | |
| RFC 7518: HMAC, RSA signatures, algorithm identifiers, and unsecured JWS. |
Related Cheatsheets
Web DevelopmentNew
React Hooks
useState, useEffect, useRef, useMemo, React 19 hooks, and custom hook patterns
Web Development
CSS Flexbox
Flex container and item properties, alignment, ordering, and common layout patterns
Web Development
CSS Grid
Grid container and item properties, template areas, auto-placement, and responsive grids