What do iss, sub and aud mean?

iss names the issuer that created the token, sub identifies the subject (usually a user ID), and aud names the service or services meant to accept it. All three are registered claims in RFC 7519 section 4.1, and all are optional.

What is the difference between iat, nbf and exp?

All three are NumericDate values, counted in seconds since 1970-01-01 UTC. iat is when the token was issued, nbf is the earliest time it may be accepted, and exp is when it expires. The decoder shows iat and exp as UTC dates in the status bar; nbf stays as a number in the payload JSON.

What is the jti claim for?

jti is a unique ID for one token. A server can store it to reject a replayed token or to revoke a single token before it expires. The decoder shows it as an ordinary string in the payload.

Can a JWT carry custom claims?

Any claim name that does not clash with a registered one can be added, such as roles or tenant_id. RFC 7519 recommends registering public names with IANA or using a collision-resistant name such as a URL. Custom claims appear in the payload JSON next to the registered ones.

JWT payload claims explained

Paste a JSON Web Token to read the claims in its payload, the second of its three parts. The registered claims iss, sub, aud, exp, nbf, iat and jti are defined in RFC 7519; anything else is a custom claim your application added. All decoding runs in your browser.

JWT token

⚠ Signature not verified, client-side only

VIEW

Runs entirely in your browser

How it works

A JWT consists of three Base64URL-encoded parts separated by dots. The tool splits the token, fixes URL-safe base64 encoding (replacing - with + and _ with /), pads to a multiple of 4 characters, then decodes the header and payload with atob() and parses them with JSON.parse(). The signature is not decoded. All of this runs in your browser. Our servers are not involved.

Processing runs in your browser

Your JWT is decoded entirely in your browser. Our servers are not involved at any point. Treat tokens as sensitive credentials and avoid pasting production tokens in shared or public environments. You can check this yourself in your browser's DevTools Network tab.

Technical specification

JSON Web Token (JWT) is defined in RFC 7519 (IETF, 2015). A JWT consists of three Base64url-encoded sections separated by .: header, payload, and signature. Base64url encoding is defined in RFC 4648 §5, which substitutes + with - and / with _ and omits padding, making it safe for use in URLs without percent-encoding. Signed JWTs (JWS) are specified separately in RFC 7515.

Structure: header.payload.signature (3 Base64url parts)
Standards: RFC 7519 (JWT), RFC 7515 (JWS), RFC 4648 (Base64url)
Header claims: alg (algorithm), typ (token type)
Common payload claims: sub, iss, exp, iat, aud

Related operations

To inspect the raw Base64 segments of a token, try Base64. For verifying the signing input by hash, use the hash generator. To pretty-print decoded payloads, see the JSON formatter.

Frequently asked questions

What do iss, sub and aud mean?: iss names the issuer that created the token, sub identifies the subject (usually a user ID), and aud names the service or services meant to accept it. All three are registered claims in RFC 7519 section 4.1, and all are optional.
What is the difference between iat, nbf and exp?: All three are NumericDate values, counted in seconds since 1970-01-01 UTC. iat is when the token was issued, nbf is the earliest time it may be accepted, and exp is when it expires. The decoder shows iat and exp as UTC dates in the status bar; nbf stays as a number in the payload JSON.
What is the jti claim for?: jti is a unique ID for one token. A server can store it to reject a replayed token or to revoke a single token before it expires. The decoder shows it as an ordinary string in the payload.
Can a JWT carry custom claims?: Any claim name that does not clash with a registered one can be added, such as roles or tenant_id. RFC 7519 recommends registering public names with IANA or using a collision-resistant name such as a URL. Custom claims appear in the payload JSON next to the registered ones.

Last reviewed September 30, 2026

Other pages for this tool

Related tools

Background reading: Complete guide to developer tools