Size Analyzer

Size Analyzer

Updated August 27, 2026

The JWT spec has no size limit. Your cookie jar and your reverse proxy do.

A token that still decodes can be why every request returns 431 or the cookie silently disappears.

Paste the token. You get characters, bytes, and a header / payload / signature split. The payload is almost always the part that blew up.

How to use it

  1. Watch the on-wire total. Base64url is about 4/3 of the JSON.
  2. Cookie JWTs need to stay under ~4 KB. Authorization tokens share the whole header block, often capped near 8 KB.
  3. Header and signature barely move. Growth is custom claims: permission arrays, profile blobs, long claim names.
  4. Shrink it. Keep sub and exp (maybe a role) and fetch the rest from your API.

When it breaks

  • 431 or a load-balancer 400 is often this token, not your app.
  • A cookie over ~4 KB gets dropped. The user looks logged out.
  • This page measures size. It does not verify the signature. Decode is not verify. Don't paste live production tokens.

Features

  • Characters, bytes, and a header / payload / signature split
  • Watches the on-wire total: Base64url is about 4/3 of the JSON
  • Cookie JWTs need to stay under ~4 KB; Authorization headers are often capped near 8 KB
  • Growth is custom claims: permission arrays, profile blobs, long claim names
  • Measures size. It does not verify the signature

Common Use Cases

  • A token that still decodes can be why every request returns 431
  • A cookie over ~4 KB gets dropped and the user looks logged out
  • Finding which claims blew up the payload
  • Keeping sub and exp (maybe a role) and fetching the rest from your API

The JWT spec has no size limit

The JWT spec has no size limit. Your cookie jar and your reverse proxy do. A token that still decodes can be why every request returns 431 or the cookie silently disappears.

Paste the token. You get characters, bytes, and a header / payload / signature split. The payload is almost always the part that blew up. Watch the on-wire total. Base64url is about 4/3 of the JSON.

Cookie JWTs need to stay under ~4 KB. Authorization tokens share the whole header block, often capped near 8 KB. Header and signature barely move. Growth is custom claims: permission arrays, profile blobs, long claim names. Shrink it. Keep sub and exp (maybe a role) and fetch the rest from your API.

431 or a load-balancer 400 is often this token, not your app. A cookie over ~4 KB gets dropped. The user looks logged out. This page measures size. It does not verify the signature. Decode is not verify. Don't paste live production tokens.

Examples

Valid - A compact token with few claims
{ "sub": "123", "exp": 1916239022 }
Invalid - Bloated payload (large claims add up fast)
{ "sub": "123", "permissions": ["a","b","c","d","e","f","g"], "profile": { "bio": "..." } }

Frequently Asked Questions

How big can a JWT be?

The JWT spec has no size limit. Your cookie jar and your reverse proxy do. Cookie JWTs need to stay under ~4 KB. Authorization tokens share the whole header block, often capped near 8 KB.

What makes a token large?

Paste the token. You get characters, bytes, and a header / payload / signature split. The payload is almost always the part that blew up. Header and signature barely move. Growth is custom claims: permission arrays, profile blobs, long claim names. Watch the on-wire total. Base64url is about 4/3 of the JSON.

How do I shrink a token?

Shrink it. Keep sub and exp (maybe a role) and fetch the rest from your API.

Why am I seeing 431 or a load-balancer 400?

431 or a load-balancer 400 is often this token, not your app. A cookie over ~4 KB gets dropped. The user looks logged out.

Does this page verify the signature?

This page measures size. It does not verify the signature. Decode is not verify. Don't paste live production tokens.

Common Mistakes

431 or a load-balancer 400 is often this token, not your app.
A cookie over ~4 KB gets dropped. The user looks logged out.
This page measures size. It does not verify the signature. Decode is not verify. Don't paste live production tokens.

Related Tools

JWT Decoder

See exactly which claims are in the payload

Try it

JWT Claims Viewer

Identify claims you could trim

Try it

JWT Expiration Checker

Review the timing claims in your token

Try it