JWT Decoding·6 min read·2026-02-15T09:00:00Z

JWT Payload Explained: Public vs. Private Claims and Token Size Hygiene

The payload contains the core statements (claims) about an entity (typically the authenticated user) and additional metadata. Structuring claims cleanly ensures efficient transmission and eliminates security oversights.

The Three Categories of JWT Claims

RFC 7519 defines three claim categories: 1. **Registered Claims**: Predefined, recommended claims (`iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, `jti`). 2. **Public Claims**: Defined by user communities, usually collision-resistant names (e.g. URI prefixes). 3. **Private Claims**: Custom claims agreed upon by producer and consumer (e.g. `roles`, `tenantId`, `permissions`).

Frequently Asked Questions

Should I put passwords or API secrets in a JWT payload?

Never! Payloads are merely Base64URL-encoded and can be read by any client, proxy, browser extension, or intermediary log.

JWT Payload Explained – Structure, Claims & Token Hygiene | مولد مفتاح JWT السري | JWT Secret Key Generator