JWT Cheat Sheet

JWT structure

eyJhbGciOiJIUzI1NiJ9 . eyJzdWIiOiJ1MSIsImV4cCI6MTc5MzEzNjk0NH0 . 4QqPoCaM-dIEMoFGEy3...
└──── header ─────┘   └──────────────── payload ─────────────────┘   └── signature ──┘
{"alg":"HS256"}        {"sub":"u1","exp":1793136944}                  HMAC or signature bytes

• Three parts separated by dots, each Base64URL-encoded (no padding, - and _ instead of + and /).
• The header and payload are encoded, not encrypted. Anyone with the token can read them. Never put passwords or secrets in a JWT.
• The signature covers header.payload. Changing a single character of either breaks it.
• Times (exp, iat, nbf) are seconds since 1 January 1970 UTC, not milliseconds.

Registered claims

These seven are the registered claims from RFC 7519. All are optional, but most APIs require exp, iss and aud.

Common OpenID Connect and OAuth claims

Header fields

Algorithms: HS256 vs RS256 vs ES256

Security checklist

• Verify the signature on every request, with an allow-list of algorithms (e.g. only RS256). Never let the token's alg choose.
• Reject alg: none and empty signatures.
• Check exp and nbf, allowing at most a minute of clock skew.
• Check iss and aud — a valid token from another app or issuer is not valid for yours.
• Don't mix up key types: an RS256 public key must never be accepted as an HS256 secret (the "algorithm confusion" attack).
• Load keys only from a trusted JWKS URL, matched by kid. Ignore jku, x5u and jwk in the token.
• Keep access tokens short-lived (minutes) and use refresh tokens to renew them. A JWT can't be revoked before it expires unless you keep a deny-list of jti values.
• Use long random HMAC secrets — short ones can be brute-forced offline from a single token.
• Never put secrets in the payload. It's readable by anyone who sees the token.

Verify a JWT in code

Each example checks the signature with a fixed algorithm and validates the issuer, audience and expiry.

// Node.js — npm install jsonwebtoken
const jwt = require('jsonwebtoken');
const claims = jwt.verify(token, publicKey, {
  algorithms: ['RS256'],
  issuer: 'https://auth.example.com',
  audience: 'my-api',
});

# Python — pip install pyjwt[crypto]
import jwt
claims = jwt.decode(
    token, public_key,
    algorithms=["RS256"],
    issuer="https://auth.example.com",
    audience="my-api",
)

// Go — github.com/golang-jwt/jwt/v5
tok, err := jwt.Parse(tokenString,
    func(t *jwt.Token) (any, error) { return publicKey, nil },
    jwt.WithValidMethods([]string{"RS256"}),
    jwt.WithIssuer("https://auth.example.com"),
    jwt.WithAudience("my-api"),
)

Common JWT errors

Other libraries use similar wording, for example PyJWT raises ExpiredSignatureError and InvalidSignatureError.

Frequently asked questions