What the header does
The header is the first segment of a JWT. It describes the token: which algorithm signs it, what type it is, and which key was used. It is a small JSON object that is Base64URL encoded and placed before the first dot of the token.
Common header fields
- alg: the signing algorithm, such as HS256, RS256 or ES256. Required.
- typ: the token type, normally JWT.
- kid: the key ID, which tells the receiver which key to use when several are in rotation.
- cty: the content type, used for nested tokens.
- jku, jwk, x5u, x5c, x5t: ways to point to or carry the public key or certificate.
- crit: lists extensions that the receiver must understand.
Header in, header out
The builder shows the header as readable JSON and as the exact Base64URL text that would appear in a token. The decoder box does the reverse: paste the first segment of any token and read the JSON.
Security note
Never trust the alg value in a token you receive without checking it against your own allowed list. Accepting none, or switching between HMAC and public-key algorithms on the receiver, has caused real security problems.
When your header is ready, sign a token with the JWT encoder. To build the payload, use the claims builder. Learn how the three parts fit together in the JWT guide.