JWT
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
JWT Preview.
At a glance
| Purpose | A JSON Web Token: a Base64url header, payload and signature separated by dots. |
| Extensions | .jwt |
| Poka parser | poka-jwt |
| Viewer | poka-tree-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B2 Broad (see Breadth tiers) |
How much Poka reads
B2 Broad. The common content of the current and the common older versions is decoded. Some named features or versions are not, and are listed.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-jwt/src/main.rs (543 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has josekit_RS256.jwt, read by no test. Covers .jwt and .idtoken. The tree decodes the header (alg, typ, kid and any other fields, with a warning for alg none), the payload's registered claims (exp, iat and nbf as UTC dates, iss, sub, aud) and every custom claim recursively, and the signature's algorithm and length. Judgement: B2: the token's claims are decoded in full; the gaps are verification and encrypted tokens.
What Poka does not read
- The signature is not verified (no key)
- Encrypted tokens (JWE, five parts) are refused
- Nested claims are cut at depth 6 and arrays at 8 items (judgement from the code)
- Only the first 64 KiB is read
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- serde_json (used; MIT OR Apache-2.0; Rust)
- jsonwebtoken (candidate; MIT; Rust; https://github.com/Keats/jsonwebtoken) — decode() returns header and claims; decode_header() reads the header without verification
Sources
- parsers/poka-jwt/src/main.rs
- parsers/poka-jwt/plugin.json