JWT Size Calculator — Measure Token Length vs HTTP Header & Cookie Limits

Why JWT Size Matters

A JWT is transmitted on every single HTTP request your authenticated client makes. A 500-byte token in a cookie means 500 bytes of outbound bandwidth per request, consumed by both the client (upload bandwidth, mobile battery) and the server (parsing time, header buffer memory). At scale, token size becomes an infrastructure cost line: a 2 KB JWT on a 1 M requests-per-day API eats 2 GB of header-only bandwidth per day — and that is the smaller of the problems. Once a token exceeds infrastructure limits, requests fail outright with cryptic errors.

Size Breakdown by Segment

Infrastructure Size Limits

Diagnosing a 431 Error

1. Reproduce with curl -v YOUR_URL — the response headers show which server rejected it.
2. Count header bytes: curl -s -o /dev/null -D - YOUR_URL -H "Authorization: Bearer $JWT" -H "Cookie: $COOKIE" → sum the Request section bytes.
3. Isolate — remove the JWT. If 431 goes away, the token is the culprit. If not, other headers (like oversized Referer, custom tracing headers) are at fault.
4. Check for duplication — browsers often send the JWT as both Cookie and Authorization. Pick one.
5. Decode the token (use the decoder above) and look at the payload size. If over 500 bytes, see "Trimming Techniques" below.

Trimming Techniques (Ranked by Impact)

1. Switch RS256 → ES256 or HS256. Saves ~250 bytes immediately. Only applies if you control the issuer. ES256 keeps asymmetric keys (needed for third-party verification).
2. Move user profile out of the payload. Store name, email,avatar_url, preferences in your database, keyed by sub. The JWT only needs to identify the user — the application looks up the rest.
3. Compress role / scope lists. "scope": "read write admin" (23 bytes) beats "scopes": ["read", "write", "admin"] (34 bytes). RFC 6749 §3.3 specifies space-delimited.
4. Shorten custom claim names. "t": "org_1" instead of"tenant_id": "org_1". Trade readability for bandwidth; worth it on high-RPS APIs.
5. Drop URI-namespaced claims for internal services."https://myapp.com/role": "admin" wastes 24 bytes vs "role": "admin". Namespacing only matters when tokens cross organisational boundaries.
6. Reference-token pattern. If you still need to carry 20+ fields of per-user data, put a session ID in the JWT ("sid": "sess_a8b3c4d5") and store the heavy payload in Redis. The JWT remains compact; the app looks up the session on request.
7. Drop jti if you do not use revocation. UUIDs are 36 bytes; GUIDs 32. If you cannot revoke tokens anyway, you are paying for a feature you do not use.

Measuring Each Segment

// JavaScript — breakdown by segment
const jwt = 'eyJhbGciOiJIUzI1NiI...';
const [header, payload, signature] = jwt.split('.');
console.log({
  total: jwt.length,
  header: header.length,
  payload: payload.length,
  signature: signature.length,
  overhead: 2,                             // the two dots
  decoded_header: atob(header).length,     // what the actual JSON looks like
  decoded_payload: atob(payload).length,
});

# Python — same breakdown
import base64
header, payload, sig = jwt.split('.')
print({
  'total': len(jwt),
  'header': len(header),
  'payload': len(payload),
  'signature': len(sig),
  'decoded_header_json': len(base64.urlsafe_b64decode(header + '==')),
  'decoded_payload_json': len(base64.urlsafe_b64decode(payload + '==')),
})

Base64URL Encoding Math

Base64URL encoding adds roughly 33% to raw byte size: N bytes of JSON becomeceil(N/3) × 4 Base64URL characters, minus any = padding (removed in JWT per RFC 7515). Concrete examples: 32 bytes → 43 chars, 48 bytes → 64 chars, 100 bytes → 134 chars. Rule of thumb: multiply the decoded JSON size by 1.33 to estimate the encoded JWT size.

Related JWT Tools

• JWT Decoder Online — decode and measure a token
• JWT Payload Example — understand what inflates payload size
• JWT HS256 Decoder — the smallest-signature algorithm
• JWT ES256 Decoder — compact asymmetric alternative to RS256
• JWT RS256 Decoder — the token-bloating but widely-used algorithm
• JWT Debugger — full decode and verify workflow