Guide

Custom claims (public vs private)

Beyond registered claims (iss, exp, ...), the kinds of claims you define yourself and how to avoid collisions.

Registered claims: the RFC 7519 standard set (iss, sub, aud, exp, nbf, iat, jti). Their meaning is fixed and interoperable.
Public claims: claims used publicly, registered with IANA or given a collision-free name.
Private claims: private claims agreed between specific parties (role, plan, ...) — risk of collision, so avoid short, common names.
Tip: don't put sensitive data even in custom claims, and to avoid collisions some use a URI namespace (e.g. https://myapp.com/roles).

Try decoding a token yourselfJust paste and the header, payload and claims unfold instantly.

Open the decoder

Related

A JWT (JSON Web Token) is a small, signed JSON token format for securely passing information between parties.

The three-part JWT structure

Every JWT consists of header.payload.signature, and each part is base64url encoded.

JWT security checklist

A short checklist of the key principles for using JWT safely.

JWT vs session authentication

The difference between token (JWT) auth and server session (cookie) auth, and when to use each.

Common JWT errors and fixes

The errors you meet most often when working with JWT, with their causes and fixes.

Access tokens and refresh tokens

The role of the short-lived access token and the refresh token that renews it.

JWS vs JWE (signed vs encrypted)

A JWT is usually a signed JWS; to hide the content you use an encrypted JWE. Here is the difference.

Where to store a JWT: localStorage vs cookie

Where you store a JWT in the browser changes your XSS and CSRF risk.

JWT in OAuth 2.0 & OpenID Connect

How JWT is used in OAuth 2.0 and OpenID Connect.