Estimate JWT token sizes before implementation. Compare algorithms, check size limits for cookies, headers, and URLs, and optimize your token payload for better performance.
Fast symmetric signing with 256-bit hash
Enter a valid JSON object with your JWT claims (e.g., sub, iat, exp, custom claims)
You might also find these calculators useful
JSON Web Tokens (JWT) are the industry standard for secure authentication and authorization. However, token size impacts performance, storage limits, and network overhead. Our JWT Token Size Calculator helps you estimate token sizes, compare algorithms, and optimize your payload before writing any code.
Browsers limit cookies to 4KB. Large JWTs stored in cookies can cause silent failures and authentication issues.
JWTs are sent with every authenticated request. Smaller tokens mean faster page loads and lower bandwidth costs.
RSA signatures are much larger than ECDSA or HMAC. Understanding the tradeoffs helps you choose wisely.
Passing JWTs in URL parameters has strict length limits (~2000 characters). Calculate before implementing.
Base64 encoding converts binary data to ASCII text using 64 characters. Every 3 bytes of input become 4 characters of output, resulting in approximately 33% size increase.
HMAC algorithms (HS256, HS384, HS512) produce the smallest signatures (32-64 bytes). ECDSA (ES256) is a good balance with 64-byte signatures and asymmetric key benefits. RSA signatures are largest at 256+ bytes.
Include only essential claims. Standard claims (sub, iat, exp) are fine. Avoid storing large objects—use IDs instead and look up data server-side. Never store sensitive data like passwords.
The header contains the algorithm ('alg') and optionally the type ('typ'). Including 'typ:JWT' adds about 15 characters to the final token. Most implementations include it by default.
JWTs don't support built-in compression. If you need smaller tokens, consider JWE (encrypted JWTs) with deflate compression, or simply minimize your claims. For very large data, use database references instead.
Keep tokens under 4KB for cookie storage, under 2KB for URL parameters, and under 8KB for HTTP headers. For best performance, aim for under 1KB—this covers most authentication use cases.