JWT Payload Size Calculator

Compute encoded JWT size from claims, roles and signature algorithm, then check it against cookie and HTTP header limits.

Inputs

Standard and custom claimsclaims

Average bytes per claimbytes

Roles or groups in the tokenentries

Average bytes per role entrybytes

JOSE header bytesbytes

Signature algorithm

Transport limit to test against

Encoded Token Size

1,280characters

Encoded Payload

888characters

Encoded Header

48characters

Encoded Signature

342characters

Encoding and Signature Overhead

48.0%

Transport Limit Utilisation

31.3%

Assessment

Fits comfortably

Step by step

Values used
Standard and custom claims = 14 claims; Average bytes per claim = 32 bytes; Roles or groups in the token = 12 entries; Average bytes per role entry = 18 bytes; JOSE header bytes = 36 bytes; Signature algorithm = RS256 / PS256 — 256-byte RSA-2048; Transport limit to test against = Cookie — 4096 bytes
JWT Payload Size
encoded size = ceil(header bytes × 4/3) + ceil(payload bytes × 4/3) + ceil(signature bytes × 4/3) + 2 dot separators.
Signature size by algorithm
Signature sizes: HS256 32 B, ES256 64 B, ES512 132 B, RS256 256 B, RS512 512 B — all before base64url expansion.
Encoded Token Size
= 1,280 characters
Encoded Payload
= 888 characters
Encoded Header
= 48 characters
Encoded Signature
= 342 characters
Encoding and Signature Overhead
= 48.0
Transport Limit Utilisation
= 31.3

How it works

JWTs are base64url-encoded, so every three bytes of JSON become four characters, and the signature is encoded the same way. Group and role claims dominate real tokens: a hundred group memberships add more bytes than every standard claim combined. Tokens that outgrow a 4 KB cookie or an 8 KB header buffer fail in ways that look nothing like an auth problem — silently dropped cookies, HTTP 431, or a redirect loop that only affects users in many groups.

Formulas

JWT Payload Size

encoded size = ceil(header bytes × 4/3) + ceil(payload bytes × 4/3) + ceil(signature bytes × 4/3) + 2 dot separators.

2: The two dots joining the three JWT segments
4/3: base64url expansion — every 3 bytes become 4 characters
payload bytes: Claims plus role or group entries plus JSON punctuation

Signature size by algorithm

Signature sizes: HS256 32 B, ES256 64 B, ES512 132 B, RS256 256 B, RS512 512 B — all before base64url expansion.

RS256: RSA-2048 signature — 342 characters once encoded, four times an ES256 signature

Frequently Asked Questions

How is JWT Payload Size calculated?

encoded size = ceil(header bytes × 4/3) + ceil(payload bytes × 4/3) + ceil(signature bytes × 4/3) + 2 dot separators. JWTs are base64url-encoded, so every three bytes of JSON become four characters, and the signature is encoded the same way. Group and role claims dominate real tokens: a hundred group memberships add more bytes than every standard claim combined.

Why does JWT Payload Size matter?

Tokens that outgrow a 4 KB cookie or an 8 KB header buffer fail in ways that look nothing like an auth problem — silently dropped cookies, HTTP 431, or a redirect loop that only affects users in many groups.

What values do I need to enter?

This calculator takes 7 inputs: Standard and custom claims, Average bytes per claim, Roles or groups in the token, Average bytes per role entry, JOSE header bytes, Signature algorithm, Transport limit to test against. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why do tokens break for users in many groups?

Because group claims scale with membership while everything else is fixed. Entra ID stops emitting the groups claim past roughly 150–200 groups and substitutes a Graph overage indicator precisely to avoid this. The general fix is to emit only the groups the application needs, or to look them up server-side.

How do I shrink a JWT?

Drop redundant custom claims, shorten claim names, replace group lists with a single roles claim scoped to the application, prefer ES256 over RS256 to save around 250 characters of signature, and if it is still too big, switch to an opaque reference token and resolve the claims through introspection.

You might also need

JWT Expiry Calculator SAML Assertion Size Calculator IAM Policy Size Calculator