Supabase JWT Decoder
Paste a Supabase access token to decode its role, metadata, and custom claims. Verify the HS256 signature using your project's JWT secret from the Supabase dashboard.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Supabase JWTs
Supabase Auth issues JWTs that are central to its Row Level Security (RLS) model. Every request to the Supabase API carries a JWT — either the anon key (for unauthenticated requests) or a user-specific access token issued after sign-in. Supabase's PostgREST API reads the JWT and makes it available as auth.jwt() inside RLS policies, allowing row-level access control directly in SQL.
Unlike many providers that use RS256, Supabase signs JWTs with HS256 using a shared JWT secret. You can find this secret in the Supabase dashboard under Project Settings > API > JWT Secret. This means verification requires the shared secret rather than a public key — paste it into the signature panel above to verify.
The role claim is the most important Supabase-specific claim: it is 'anon' for unauthenticated requests and 'authenticated' for signed-in users. app_metadata is set server-side by admins and cannot be modified by users — ideal for storing trusted data like subscription tier. user_metadata can be updated by the user themselves. Custom claims can be added via a custom access token hook.
Common Supabase claims
roleSupabase role — 'anon' for unauthenticated, 'authenticated' after sign-in.
e.g. authenticated
subThe Supabase user UUID — stable identifier for the user.
e.g. a1b2c3d4-...
emailThe user's email address from Supabase Auth.
e.g. jane@example.com
app_metadataServer-set metadata — cannot be modified by the user.
e.g. {"provider":"email"}
user_metadataUser-editable metadata set during sign-up or profile update.
e.g. {"name":"Jane"}
audAudience — matches the role for Supabase tokens.
e.g. authenticated
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.