What is in a JWT header?
The header is the first part of a token, before the first dot. It is a small JSON object that is Base64URL encoded. It tells the receiver how to treat the rest of the token.
Common header fields
- alg: the signing algorithm, such as HS256, RS256 or ES256. Required.
- typ: the token type, normally JWT.
- kid: the key ID, used to pick the right key when several are in rotation.
- jku, jwk, x5u, x5c: ways to point to or carry the public key or certificate.
- cty and crit: content type and required extensions.
Why the header matters for security
The header is not protected by trust, only by the signature. A receiver must never accept whatever alg the token names. Keep a fixed list of allowed algorithms, reject none, and do not fetch keys from a URL that the token itself supplies.
Decode or build?
This page reads a header from an existing token. To write a header and get its Base64URL form, use the JWT header builder. For the full token use the JWT decoder, and for the second part see the payload decoder. The JWT guide explains how the parts fit together.