JWT decoder · Guide
JWT Claims Explained: sub, iss, aud, exp and More
JWT claims are just fields in the payload, but the registered ones have standard meanings worth knowing. Here is the short reference.
Identity claims
sub identifies the subject (usually the user), iss names the issuer that minted the token, and aud states the intended audience. Verifiers check iss and aud to ensure a token is meant for them.
Timing claims
exp is the expiry, iat the issued-at time, and nbf a "not before" time that delays validity. All are Unix timestamps in seconds.
Custom claims
Beyond the registered set, applications add their own claims — roles, permissions, tenant IDs. Decode the payload to see exactly which custom claims a token carries.
Frequently asked questions
Can I use this for production work?
Yes, for inspection, formatting and quick generation. Still review the output before committing it to production code or configuration.
Ready to try it?
Open the free browser-based JWT decoder and apply what you just read — no sign-up, runs locally.
Open the JWT decoder tool