Keep this JWT Cheat Sheet bookmarked as your quick reference guide for token structure, registered claims, JOSE header parameters, cryptographic algorithms, and command-line debugging snippets.
1. JWT Structure at a Glance
A JSON Web Token consists of three parts separated by periods (.):
🧩 Anatomy of a JSON Web Token (RFC 7519)
Token StructureAnatomy of a Compact JWT
header.payload.signature
[Header] Base64URL encoded JSON: {"alg": "HS256", "typ": "JWT"}
.
[Payload] Base64URL encoded JSON: {"sub": "123", "name": "Jane", "admin": true}
.
[Signature] HMACSHA256(Base64Url(Header) + "." + Base64Url(Payload), secret)2. Standard Registered Claims (RFC 7519 Section 4.1)
All registered claim names are 3 characters long to keep tokens compact:
| Claim | Full Name | Type | Description | Example |
|---|---|---|---|---|
iss |
Issuer | String / URI | The principal that issued the JWT | "https://auth.example.com" |
sub |
Subject | String | The principal that is the subject (User ID) | "usr_987654321" |
aud |
Audience | String / Array | The recipients that the JWT is intended for | "https://api.example.com" |
exp |
Expiration Time | NumericDate | Unix epoch seconds after which the JWT is invalid | 1792497600 |
nbf |
Not Before | NumericDate | Unix epoch seconds before which the JWT is invalid | 1792494000 |
iat |
Issued At | NumericDate | Unix epoch seconds at which the JWT was created | 1792494000 |
jti |
JWT ID | String | Unique identifier for the token (used for revocation) | "b2a7-98ef-41cd" |
3. Standard JOSE Header Parameters
alg: Signing or encryption algorithm (e.g.,"HS256","RS256","ES256","none"). Required.typ: Token type. Recommended value:"JWT".cty: Content type. Used for nested or encrypted tokens.kid: Key ID. Hint indicating which key was used to sign the token.jku: JWK Set URL. URL pointing to the JSON Web Key set.x5c: X.509 certificate chain.
4. Common Algorithms Summary (RFC 7518 JWA)
| Algorithm | Type | Hash Function | Key Type | Recommended Use Case |
|---|---|---|---|---|
| HS256 | Symmetric HMAC | SHA-256 | Shared Secret (≥ 256 bits) | Monolithic apps, high speed |
| HS384 / HS512 | Symmetric HMAC | SHA-384 / SHA-512 | Shared Secret | Higher cryptographic security margins |
| RS256 | Asymmetric RSA | SHA-256 | RSA Keypair (≥ 2048 bits) | Microservices, OAuth 2.0, OpenID Connect |
| PS256 | Asymmetric RSA-PSS | SHA-256 | RSA Keypair with PSS padding | Modern enterprise security standards |
| ES256 | Asymmetric ECDSA | SHA-256 | P-256 Elliptic Curve | Mobile apps, WebAuthn, fast & compact |
| EdDSA | Asymmetric Edwards | SHA-512 (Ed25519) | Curve25519 Keypair | Next-generation high performance crypto |
5. Command-Line (CLI) Power Snippets
Decode JWT Header & Payload in Bash (using jq)
# Decode Header:
echo $TOKEN | cut -d. -f1 | tr '_-' '/+' | base64 -d 2>/dev/null | jq .
# Decode Payload:
echo $TOKEN | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | jq .Check Token Expiration Date in Terminal
EXP=$(echo $TOKEN | cut -d. -f2 | tr '_-' '/+' | base64 -d 2>/dev/null | jq -r .exp)
date -r $EXP "+%Y-%m-%d %H:%M:%S" # macOS / BSD
# date -d @$EXP "+%Y-%m-%d %H:%M:%S" # LinuxSend Bearer Token with cURL
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/v1/profile