JWT Reference: Claims, Algorithms and Header Fields
One page per claim, signing algorithm and header parameter you are likely to meet in a JSON Web Token. Each says what the field asserts, which document registers it, what a verifier is supposed to do with it, and the mistakes that get made with it. Registered here means registered in the IANA registries behind RFC 7519 and RFC 7515, which is a much wider set than the seven claims RFC 7519 defines itself. The decoder on every page takes a token apart and verifies its signature in your browser.
Every page here embeds the JWT Decoder. Paste a token to decode the header and payload, read the claims and expiry, and verify the signature in your browser. Nothing is uploaded.
48 pages in this section.
Group Registered claims
iss (Issuer) Claim in a JWT
The iss claim names who issued a token. What goes in it, why validators compare it byte for byte, and how the decoder displays it.
sub (Subject) Claim in a JWT
The sub claim says who the token is about. Why it is only unique within one issuer, what pairwise subjects change, and how the decoder shows it.
aud (Audience) Claim in a JWT
The aud claim names who a token is for. Why every API must check it, how the string and array forms differ, and what the decoder shows.
exp (Expiration Time) Claim in a JWT
The exp claim sets when a JWT stops being accepted. NumericDate format, clock skew allowances, and the four expiry states the decoder shows.
nbf (Not Before) Claim in a JWT
The nbf claim marks the earliest time a JWT may be accepted. When a not before time is worth setting, and how the decoder flags a future one.
iat (Issued At) Claim in a JWT
The iat claim records when a JWT was created. What it is good for, why it is not an expiry, and the age and lifetime figures the decoder derives.
jti (JWT ID) Claim in a JWT
The jti claim gives a JWT a unique identifier. How it supports replay detection and denylists, what it costs to store, and how the decoder shows it.
azp (Authorized Party) Claim in a JWT
The azp claim names the client an ID token was issued to. When OpenID Connect requires it, how it differs from aud, and what the decoder shows.
nonce Claim in an OpenID Connect ID Token
The nonce claim binds an ID token to one authentication request. How the value round trips, why it must be compared, and how the decoder shows it.
auth_time Claim in an OpenID Connect ID Token
The auth_time claim records when the end user actually authenticated, not when the token was issued. How max_age uses it and how the decoder shows it.
acr (Authentication Context Class Reference) Claim
The acr claim states how strongly the user was authenticated. Why its values are provider specific, what the value 0 means, and how the decoder shows it.
amr (Authentication Methods References) Claim
The amr claim lists how the user authenticated. The registered values from RFC 8176, why the list is not proof of strength, and what the decoder shows.
at_hash (Access Token Hash) Claim in an ID Token
The at_hash claim ties an ID token to the access token issued with it. How the left half hash is computed, when it must be checked, and decoder limits.
c_hash (Code Hash) Claim in an ID Token
The c_hash claim binds an ID token to the authorization code returned with it. Where hybrid flows need it, how it is computed, and what the decoder shows.
sid (Session ID) Claim in a JWT
The sid claim identifies the authentication session at the provider. How single logout uses it, why it is not the user identifier, and decoder behaviour.
scope Claim in a JWT Access Token
The scope claim carries the granted OAuth scopes inside an access token. Why it is one space delimited string, how to check it, and what the decoder shows.
client_id Claim in a JWT Access Token
The client_id claim names the OAuth client an access token was issued to. How it differs from sub and azp, where it is required, and decoder behaviour.
act (Actor) Claim in a JWT
The act claim names the party acting on behalf of the subject. How nesting records a delegation chain, and why the decoder shows it as raw JSON.
may_act (Authorized Actor) Claim in a JWT
The may_act claim states which party may act on behalf of the subject. How it gates a token exchange, how it pairs with act, and what the decoder shows.
cnf (Confirmation) Claim in a JWT
The cnf claim binds a token to a key its holder must prove. How mTLS and DPoP use it, why it stops replay of a stolen token, and decoder limits.
email Claim in an OpenID Connect ID Token
The email claim carries the end user's email address. Why it must not be used as an account key, what scope returns it, and what the decoder shows.
email_verified Claim in an OpenID Connect ID Token
The email_verified claim says whether the provider verified the address. Why account linking depends on it, the string true trap, and decoder behaviour.
preferred_username Claim in an ID Token
The preferred_username claim carries a shorthand name for the user. Why OpenID Connect says it is neither unique nor stable, and how the decoder shows it.
Group Algorithms
HS256: HMAC with SHA-256 in a JWT
HS256 signs a JWT with a shared secret using HMAC and SHA-256. Key sizing, the algorithm confusion attack, and verifying one in your browser.
HS384: HMAC with SHA-384 in a JWT
HS384 signs a JWT with a shared secret using HMAC and SHA-384. How it differs from HS256, why SHA-384 is a truncated SHA-512, and verification support.
HS512: HMAC with SHA-512 in a JWT
HS512 signs a JWT with a shared secret using HMAC and SHA-512. Secret sizing, the token size cost, and how the decoder verifies one in your browser.
RS256: RSASSA-PKCS1-v1_5 with SHA-256 in a JWT
RS256 signs a JWT with an RSA private key and verifies with the public key. Key sizes, the RS256 to HS256 confusion attack, and verifying in your browser.
RS384: RSASSA-PKCS1-v1_5 with SHA-384 in a JWT
RS384 signs a JWT with RSA and SHA-384. What changes against RS256, what does not, and why the token size stays the same for a given key.
RS512: RSASSA-PKCS1-v1_5 with SHA-512 in a JWT
RS512 signs a JWT with RSA and SHA-512. Why the signature length follows the key rather than the hash, and what the decoder needs to verify one.
PS256: RSASSA-PSS with SHA-256 in a JWT
PS256 signs a JWT using RSA-PSS with SHA-256 and MGF1. How it differs from RS256, why two signatures differ, and verifying with a public key.
PS384: RSASSA-PSS with SHA-384 in a JWT
PS384 signs a JWT using RSA-PSS with SHA-384 and a 48 byte salt. What changes against PS256, and how the decoder verifies one in your browser.
PS512: RSASSA-PSS with SHA-512 in a JWT
PS512 signs a JWT using RSA-PSS with SHA-512 and a 64 byte salt. Why very small keys cannot carry it, and how verification works in the decoder.
ES256: ECDSA with P-256 and SHA-256 in a JWT
ES256 signs a JWT with ECDSA on curve P-256 using SHA-256. Signature format, why raw R and S beats DER here, and verifying with a public key.
ES384: ECDSA with P-384 and SHA-384 in a JWT
ES384 signs a JWT with ECDSA on curve P-384 using SHA-384. Signature length, where the curve is mandated, and verification in your browser.
ES512: ECDSA with P-521 and SHA-512 in a JWT
ES512 signs a JWT with ECDSA on curve P-521 using SHA-512. Why the curve is 521 bits, what that does to signature length, and how to verify it.
EdDSA: Edwards-curve Signatures in a JWT
EdDSA signs a JWT with Ed25519 or Ed448 under the OKP key type. What RFC 8037 defines, why it is deterministic, and why the decoder cannot verify it.
none: The Unsecured JWT Algorithm
The none algorithm means a JWT carries no signature at all. How the alg none attack works, what to configure, and how the decoder handles such a token.
Group Header parameters
alg (Algorithm) Header Parameter in a JWT
The alg header names the algorithm used to sign a JWT. Why the accepted algorithms belong in configuration, and what the decoder does with the value.
typ (Type) Header Parameter in a JWT
The typ header declares the media type of a token. Why at+jwt exists, how typ prevents cross token confusion, and what the decoder flags.
cty (Content Type) Header Parameter in a JWT
The cty header describes the payload rather than the token. How the value JWT signals a nested token, and when nesting is actually worth it.
kid (Key ID) Header Parameter in a JWT
The kid header says which key signed a token. How rotation depends on it, why the value must be a lookup and never a path, and decoder behaviour.
jku (JWK Set URL) Header Parameter in a JWT
The jku header points at a JWK Set URL for the signing key. Why following it blindly gives an attacker both forgery and SSRF, and safe handling.
jwk (JSON Web Key) Header Parameter in a JWT
The jwk header embeds the public key in the token itself. Why trusting it verifies nothing, where it is legitimate, and how the decoder treats it.
x5u (X.509 URL) Header Parameter in a JWT
The x5u header points at an X.509 certificate chain for the signing key. The SSRF and trust risks, and what a verifier has to validate.
x5c (X.509 Certificate Chain) Header Parameter
The x5c header embeds the X.509 certificate chain in the token. Why it uses standard Base64 rather than Base64URL, and how a verifier must treat it.
x5t (X.509 Certificate SHA-1 Thumbprint) Header
The x5t header holds a SHA-1 thumbprint of the signing certificate. How it selects a certificate, why SHA-1 here is not the usual problem, and what to prefer.
x5t#S256 (X.509 SHA-256 Thumbprint) Header
The x5t#S256 header holds a SHA-256 thumbprint of the signing certificate. How it is computed, where mTLS bound tokens reuse the value, and what to check.
crit (Critical) Header Parameter in a JWT
The crit header lists extension parameters a verifier must understand or reject. The rules on what may appear in it, and why it fails closed by design.