What is difference between private and public claims on jwt

Question

What is difference between private and public claims on jwt?

I'm confused with the difference between those two claims. From what I understand they are both custom claims. So what is the difference?

Answer 1

Public claims

Custom claim names that are required to be collision resistant. Their names should be UUIDs or prefixed by a URL to create a safe namespace for them and avoid collisions.

Private claims

Custom claim names that are not required to be collision resistant.

What is difference between private and public claims on jwt?

Only difference is public claims are required to be universally collision resistant while private claims are not.

Answer 2

Public claims are like public API that defined for public consumption. They should be well documented. RFC7519 defines several ways to do it.

1. You can register public claim name in the public IANA "JSON Web Token Claims" registry specified in RFC. There is whole process of approval around it. See section 10.1 https://tools.ietf.org/html/rfc7519#section-10.1
2. You have to make sure that public claim name is collision-resistant, ie are highly unlikely to collide with other names. Examples are UUID , OID or Domain names

Private claims are claims that are known only to the producer and consumer of a JWT. Private claim names are not collision-resistant and should be used with clear understanding of this and care...