What this tool does
Paste a token and every header and payload claim is broken out into its own row, tagged as either a standard claim (part of RFC 7519 or common OAuth2/OIDC conventions) or a custom one specific to the issuer — with a plain-English explanation of what each standard claim actually does. Useful when you hit an unfamiliar claim like azp or scp and don't want to go dig through a spec to find out what it means.
Standard claims explained here
Header: alg, typ, cty, kid.
Payload: iss, sub, aud, exp, nbf, iat, and jti — the seven registered claims from RFC 7519 — plus scope/scp and azp, which aren't part of the JWT spec itself but are ubiquitous in OAuth2/OIDC-issued tokens.
Anything else in the token — role, permissions, tenant_id, or whatever else an issuer decided to include — is labeled custom, since its meaning is entirely up to that specific issuer.
Why aud can look different across tokens
The aud claim is allowed to be either a single string or an array of strings per RFC 7519 — a token can be valid for more than one audience at once. This tool renders either shape the same way, joining an array into a comma-separated list.
FAQ
Does this verify the signature?
No — this tool only decodes and explains claims. For signature verification and automated security checks, use the JWT Inspector.
I just want the expiration status
The JWT Expiration Checker gives you a focused, live-updating view of just the time-related claims.
Is my token uploaded anywhere?
No — decoding happens entirely in your browser. Nothing is sent to a server.