Clerk JWT Decoder
Paste a Clerk session token or custom JWT to decode its claims — including session ID, organization ID, role, and multi-factor verification age. Verify the RS256 signature client-side.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Clerk JWTs
Clerk issues session tokens that are short-lived JWTs (valid for 60 seconds by default) used to authenticate requests to your backend. They are distinct from traditional long-lived access tokens — Clerk intentionally keeps session tokens short-lived and refreshes them frequently using the active browser session. Your backend verifies the JWT signature rather than making a network call to Clerk on every request.
Clerk also supports JWT templates, which let you issue custom JWTs with any claims you define — useful for integrating with third-party services like Supabase, Hasura, or Firebase that consume JWTs directly. Each Clerk instance exposes its JWKS at https://<your-frontend-api>/.well-known/jwks.json, which your backend uses to verify signatures.
Organization-related claims appear when the user is in an active organization: org_id is the organization's unique ID and org_role is the user's role within it (org:admin, org:member, etc.). The fva (factor verification age) claim is an array tracking when each multi-factor method was last verified. Paste your Clerk token above to decode all claims.
Common Clerk claims
sidSession ID — the unique Clerk session this token belongs to.
e.g. sess_2abc123...
subSubject — the Clerk user ID.
e.g. user_2abc123...
org_idOrganization ID — the active organization for this session.
e.g. org_2abc123...
org_roleThe user's role within the active organization.
e.g. org:admin
fvaFactor verification age — tracks MFA method verification times.
e.g. [0,1720000000]
azpAuthorized party — the origin that requested this token.
e.g. https://myapp.com
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.