Compute encoded JWT size from claims, roles and signature algorithm, then check it against cookie and HTTP header limits.
JWTs are base64url-encoded, so every three bytes of JSON become four characters, and the signature is encoded the same way. Group and role claims dominate real tokens: a hundred group memberships add more bytes than every standard claim combined. Tokens that outgrow a 4 KB cookie or an 8 KB header buffer fail in ways that look nothing like an auth problem — silently dropped cookies, HTTP 431, or a redirect loop that only affects users in many groups.
JWT Payload Size
encoded size = ceil(header bytes × 4/3) + ceil(payload bytes × 4/3) + ceil(signature bytes × 4/3) + 2 dot separators.
Signature size by algorithm
Signature sizes: HS256 32 B, ES256 64 B, ES512 132 B, RS256 256 B, RS512 512 B — all before base64url expansion.
encoded size = ceil(header bytes × 4/3) + ceil(payload bytes × 4/3) + ceil(signature bytes × 4/3) + 2 dot separators. JWTs are base64url-encoded, so every three bytes of JSON become four characters, and the signature is encoded the same way. Group and role claims dominate real tokens: a hundred group memberships add more bytes than every standard claim combined.
Tokens that outgrow a 4 KB cookie or an 8 KB header buffer fail in ways that look nothing like an auth problem — silently dropped cookies, HTTP 431, or a redirect loop that only affects users in many groups.
This calculator takes 7 inputs: Standard and custom claims, Average bytes per claim, Roles or groups in the token, Average bytes per role entry, JOSE header bytes, Signature algorithm, Transport limit to test against. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because group claims scale with membership while everything else is fixed. Entra ID stops emitting the groups claim past roughly 150–200 groups and substitutes a Graph overage indicator precisely to avoid this. The general fix is to emit only the groups the application needs, or to look them up server-side.
Drop redundant custom claims, shorten claim names, replace group lists with a single roles claim scoped to the application, prefer ES256 over RS256 to save around 250 characters of signature, and if it is still too big, switch to an opaque reference token and resolve the claims through introspection.