Skip to content
ENExplore Calculators

JWT Payload Size Calculator

Compute encoded JWT size from claims, roles and signature algorithm, then check it against cookie and HTTP header limits.

About JWT Payload Size Calculator

JWTs are base64url-encoded, so every three bytes of JSON become four characters, and the signature is encoded the same way. Group and role claims dominate real tokens: a hundred group memberships add more bytes than every standard claim combined. Tokens that outgrow a 4 KB cookie or an 8 KB header buffer fail in ways that look nothing like an auth problem — silently dropped cookies, HTTP 431, or a redirect loop that only affects users in many groups.

Formulas

JWT Payload Size

encoded size = ceil(header bytes × 4/3) + ceil(payload bytes × 4/3) + ceil(signature bytes × 4/3) + 2 dot separators.

2
The two dots joining the three JWT segments
4/3
base64url expansion — every 3 bytes become 4 characters
payload bytes
Claims plus role or group entries plus JSON punctuation

Signature size by algorithm

Signature sizes: HS256 32 B, ES256 64 B, ES512 132 B, RS256 256 B, RS512 512 B — all before base64url expansion.

RS256
RSA-2048 signature — 342 characters once encoded, four times an ES256 signature

Worked example

With the default values below, JWT Payload Size Calculator returns Encoded Token Size of 1,280. Change any input above and every figure here is recalculated in your browser.

Inputs used

Standard and custom claimsaccepts 1–500 claims
14 claims
Average bytes per claimaccepts 4–4,096 bytes
32 bytes
Roles or groups in the tokenaccepts 0–5,000 entries
12 entries
Average bytes per role entryaccepts 2–512 bytes
18 bytes
JOSE header bytesaccepts 10–2,048 bytes
36 bytes
Signature algorithmone of HS256 — 32-byte HMAC, ES256 — 64-byte ECDSA, HS512 — 64-byte HMAC, ES512 — 132-byte ECDSA, RS256 / PS256 — 256-byte RSA-2048, RS512 — 512-byte RSA-4096
RS256 / PS256 — 256-byte RSA-2048
Transport limit to test againstone of Cookie — 4096 bytes, Default nginx / Apache header — 8192 bytes, Tuned header buffer — 16384 bytes, AWS ALB header — 16384 bytes
Cookie — 4096 bytes

Results

Encoded Token Size
1,280 characters
Encoded Payload
888 characters
Encoded Header
48 characters
Encoded Signature
342 characters
Encoding and Signature Overhead
48.0%
Transport Limit Utilisation
31.3%
Assessment
Fits comfortably

Step by step

  1. 1Values used
  2. 2JWT Payload Size
  3. 3Signature size by algorithm
  4. 4Encoded Token Size= 1,280 characters
  5. 5Encoded Payload= 888 characters
  6. 6Encoded Header= 48 characters
  7. 7Encoded Signature= 342 characters
  8. 8Encoding and Signature Overhead= 48.0
  9. 9Transport Limit Utilisation= 31.3

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is JWT Payload Size calculated?

encoded size = ceil(header bytes × 4/3) + ceil(payload bytes × 4/3) + ceil(signature bytes × 4/3) + 2 dot separators. JWTs are base64url-encoded, so every three bytes of JSON become four characters, and the signature is encoded the same way. Group and role claims dominate real tokens: a hundred group memberships add more bytes than every standard claim combined.

Why does JWT Payload Size matter?

Tokens that outgrow a 4 KB cookie or an 8 KB header buffer fail in ways that look nothing like an auth problem — silently dropped cookies, HTTP 431, or a redirect loop that only affects users in many groups.

What values do I need to enter?

This calculator takes 7 inputs: Standard and custom claims, Average bytes per claim, Roles or groups in the token, Average bytes per role entry, JOSE header bytes, Signature algorithm, Transport limit to test against. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why do tokens break for users in many groups?

Because group claims scale with membership while everything else is fixed. Entra ID stops emitting the groups claim past roughly 150–200 groups and substitutes a Graph overage indicator precisely to avoid this. The general fix is to emit only the groups the application needs, or to look them up server-side.

How do I shrink a JWT?

Drop redundant custom claims, shorten claim names, replace group lists with a single roles claim scoped to the application, prefer ES256 over RS256 to save around 250 characters of signature, and if it is still too big, switch to an opaque reference token and resolve the claims through introspection.

Related Calculators

JWT Payload Size Calculator – Calculate Encoded Token Size