JWT Claims Cheat Sheet

Registered, public, and private claims for JSON Web Tokens

Registered claims (RFC 7519)

Standard claim names every verifier should understand

iss (Issuer)Who created the token

{ "iss": "https://auth.example.com" }

sub (Subject)Principal the token is about

{ "sub": "user_987654" }

aud (Audience)Intended recipient(s); string or array

{ "aud": "api.example.com" }

exp (Expiration)Unix seconds after which reject

{ "exp": 1735689600 }

nbf (Not Before)Reject until this time

{ "nbf": 1735603200 }

iat (Issued At)When the token was created

{ "iat": 1735600000 }

jti (JWT ID)Unique id for replay detection

{ "jti": "b7f3c2a1-…" }

algNever trust alg from untrusted tokens blindly

{ "alg": "HS256", "typ": "JWT" }

kidKey id for JWKS rotation

{ "alg": "RS256", "kid": "2024-01" }

Roles / scopes

{ "role": "admin", "scope": "read:orders write:orders" }

{ "email": "ada@example.com", "email_verified": true }

Tenant

{ "tid": "org_42", "org": "acme" }

Short TTLUse refresh tokens for longer sessions

exp ≈ now + 5–15 minutes for access tokens

No secrets in payloadAnyone can decode claims

Payload is Base64 — not encryption

Verify signature offlineUse your IdP JWKS / shared secret server-side

Decode ≠ verify