Standard Header Parameters (RFC 7515)
• **alg (Algorithm)**: Mandatory. Identifies the cryptographic algorithm (e.g. `HS256`, `RS256`, `ES256`).
• **typ (Type)**: Declares the media type, typically `"JWT"`.
• **kid (Key ID)**: Hints which key in a key store was used to sign the token. Crucial for key rotation.
• **crit (Critical)**: Array of header extensions that the recipient must understand to accept the token.
Generate in Browser
Launch GeneratorNeed a cryptographically secure JWT secret right now?
Generate 128 to 512-bit keys in Hex or Base64 using Web Crypto with zero server transmission.
Frequently Asked Questions
What is a SQL injection vulnerability via kid?
If a backend uses the "kid" header parameter directly in a database query to look up the signing key without parameterization, attackers can inject SQL payloads into the kid parameter.
Related Technical Guides
JWT Decoding
How to Decode a JWT: Step-by-Step Base64URL and Payload Inspection
Learn how compact JWTs are split, how Base64URL is decoded to UTF-8 JSON, and how to inspect claims safely in Python, JavaScript, and Bash.
ImplementationTop 7 Critical JWT Authentication Mistakes Developers Make in Production
Avoid disastrous security flaws: "alg": "none", weak secrets, missing expiration, storing tokens in localStorage, and trusting client payloads.