Updated August 12, 2026

JWT claims reference

A JSON Web Token carries a set of claims — statements about the token and its subject. This sheet lists the registered claims defined by RFC 7519, the header fields, and the common public claims you will see in practice.

Registered claims (RFC 7519)

All optional, but widely used. Times are Unix seconds.

Claim	Name	Purpose
`iss`	Issuer	Who issued the token, e.g. your auth server.
`sub`	Subject	Who the token is about — usually the user ID.
`aud`	Audience	Who the token is intended for; the recipient should verify it.
`exp`	Expiration Time	After this Unix time, the token must be rejected.
`nbf`	Not Before	The token is invalid before this Unix time.
`iat`	Issued At	When the token was issued; used for age checks.
`jti`	JWT ID	A unique id for the token, e.g. to prevent replay.

Header fields

Field	Purpose
`alg`	Signing algorithm, e.g. HS256, RS256, or none.
`typ`	Token type, typically "JWT".
`kid`	Key ID — which key signed the token, for rotation.

Common public claims

Claim	Purpose
`name`	Display name of the subject.
`email`	Email address of the subject.
`scope`	Space-separated OAuth scopes granted.
`roles`	Roles or permissions (non-standard, app-defined).

Claims are readable, not secretThe payload is base64url-encoded, not encrypted — anyone with the token can read the claims. Never put passwords or secrets in a JWT, and always verify the signature and exp before trusting it.

exp and nbf use Unix timeexp, nbf, and iat are NumericDate values — seconds since 1970-01-01 UTC. A token is valid when the current time is at or after nbf/iat and before exp.

References

Questions

Are JWT claims required?

No claim is strictly required by RFC 7519, but exp is strongly recommended, and iss, sub, and aud are used by most systems to scope and validate a token.

What is the difference between a claim and the header?

The header describes the token itself — the signing algorithm (alg) and type (typ). The claims are the payload: statements about the subject and the token's validity.

Can I trust the claims in a JWT?

Only after verifying the signature with the issuer's key and checking exp/nbf. Without verification, claims can be forged, since the payload is just encoded, not encrypted.