JWT Secret Key Generator
en
JWT Decoding·6 min read·Updated October 23, 2026

JWT Payload Explained: Public vs. Private Claims and Token Size Hygiene

The payload contains the core statements (claims) about an entity (typically the authenticated user) and additional metadata. Structuring claims cleanly ensures efficient transmission and eliminates security oversights.

The Three Categories of JWT Claims

RFC 7519 defines three claim categories: 1. **Registered Claims**: Predefined, recommended claims (`iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, `jti`). 2. **Public Claims**: Defined by user communities, usually collision-resistant names (e.g. URI prefixes). 3. **Private Claims**: Custom claims agreed upon by producer and consumer (e.g. `roles`, `tenantId`, `permissions`).
Generate in Browser

Need a cryptographically secure JWT secret right now?

Generate 128 to 512-bit keys in Hex or Base64 using Web Crypto with zero server transmission.

Launch Generator

Frequently Asked Questions

Should I put passwords or API secrets in a JWT payload?

Never! Payloads are merely Base64URL-encoded and can be read by any client, proxy, browser extension, or intermediary log.

Related Technical Guides

JWT Decoding

JWT Claims Explained: The Complete Reference for Standard and Custom Claims

Exhaustive developer guide to all 7 RFC 7519 registered JWT claims: syntax, formats, expiration math, and verification rules.

JWT Decoding

How to Decode a JWT: Step-by-Step Base64URL and Payload Inspection

Learn how compact JWTs are split, how Base64URL is decoded to UTF-8 JSON, and how to inspect claims safely in Python, JavaScript, and Bash.

JWT Payload Explained – Structure, Claims & Token Hygiene | JWT Secret Key Generator | JWT Secret Key Generator