JWT Claims Viewer
Paste a JWT to view all its payload claims with human-readable explanations. Inspect registered, public, and private claims — expiry dates, subject, audience, and more.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding JWT claims
JWT claims are statements about the token's subject or the token itself, encoded in the JSON payload. RFC 7519 defines three categories: registered claims (standardized names with well-known meanings), public claims (collision-resistant names agreed upon by parties), and private claims (custom names shared between specific parties). Understanding each category helps you know which claims to validate and which to use for application logic.
The seven registered claims defined in RFC 7519 are: iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (JWT ID). Servers are expected to validate iss, aud, and exp at minimum. The sub claim is the primary identifier for the entity the token represents — typically a user ID.
Paste your JWT above and switch to the Claims tab to see every claim decoded with a plain-English explanation, date formatting for timestamps, and expiry status. This is the fastest way to understand the full contents of any JWT without writing code.
Registered claims (RFC 7519)
issIssuer — the entity that issued the JWT.
e.g. https://auth.example.com
subSubject — the entity this JWT is about (usually a user ID).
e.g. user123
audAudience — the intended recipient(s) of the JWT.
e.g. https://api.example.com
expExpiration — Unix timestamp after which the token is invalid.
e.g. 1720003600
nbfNot Before — Unix timestamp before which the token is invalid.
e.g. 1720000000
iatIssued At — Unix timestamp when the token was issued.
e.g. 1720000000
jtiJWT ID — unique identifier to prevent replay attacks.
e.g. a1b2c3d4-...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.