JWT Cheatsheet — JSON Web Token Structure & Claims Reference
A concise JWT (JSON Web Token) reference guide. Covers the header, payload, and signature structure, standard claims, and security best practices.
jwt cheatsheet
json web token reference
jwt claims
jwt structure guide
jwt quick reference
JWT Structure
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| Format | header.payload.signature | Three Base64url-encoded parts separated by dots |
| Header | {"alg": "HS256", "typ": "JWT"} | Specifies the signing algorithm |
| Payload | {"sub": "1234", "name": "John", "iat": 1516239022} | Contains claims (key-value pairs) |
| Signature | HMACSHA256(base64url(header) + "." + base64url(payload), secret) | Verifies the token was not tampered with |
Registered Claims (Standard)
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| iss | Issuer — who created the token | e.g. "https://auth.yourapp.com" |
| sub | Subject — who the token is about | Usually a user ID: "user_12345" |
| aud | Audience — who the token is for | e.g. "https://api.yourapp.com" |
| exp | Expiration time (Unix timestamp) | Token rejected after this time |
| nbf | Not Before (Unix timestamp) | Token invalid before this time |
| iat | Issued At (Unix timestamp) | When the token was created |
| jti | JWT ID — unique identifier | Used to prevent token replay attacks |
Common Algorithms
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| HS256 | HMAC + SHA-256 (symmetric) | Same secret to sign and verify — for internal use only |
| RS256 | RSA + SHA-256 (asymmetric) | Private key signs, public key verifies — for APIs |
| ES256 | ECDSA + SHA-256 (asymmetric) | Smaller keys than RSA, similar security |
| PS256 | RSA-PSS + SHA-256 | More secure than RS256 but less common |
Security Rules
| Syntax / Pattern | Meaning | Example / Notes |
|---|---|---|
| ⚠️ Never decode without verifying | Always verify the signature before trusting claims | atob() decodes — it does NOT verify |
| ⚠️ Check exp | Always validate the expiration time claim | Expired tokens must be rejected |
| ⚠️ Reject "alg: none" | The "none" algorithm means no signature | A major vulnerability if not rejected |
| ✅ Store securely | Use httpOnly cookies, not localStorage | localStorage is vulnerable to XSS attacks |
| ✅ Short expiry | Access tokens: 15 min. Refresh tokens: 7 days | Shorter = less damage if stolen |
Frequently Asked Questions
Can I decode a JWT without the secret?
You can decode the header and payload without the secret (they are just Base64url-encoded). However, you cannot VERIFY the signature without the secret or public key. Never trust unverified JWT claims.
Where should I store a JWT?
For web apps: httpOnly Secure cookies are the safest. Avoid localStorage (vulnerable to XSS). Avoid sessionStorage (same risk). Always transmit over HTTPS.
Ready to put this to use?
Test patterns interactively in our live tool.