Practically speaking, you don't want JWTs over around 6 or 7KB unless there's a good reason. The justification for that number is that JWTs may or may not need

Practically speaking, you don't want JWTs over around 6 or 7KB unless there's a good reason. The justification for that number is that JWTs may or may not need to be included in headers. More headers may or may not be added if Proxies/LBs/etc are involved between communicating machines. Some webservers have default header limits around 8kb, and that's how we get to this number.