Parse JWT Claims

Understanding JWT Claims

JWT claims are the key-value pairs in the token's payload section. Standard claims are defined by RFC 7519: iss (issuer — who created the token), sub (subject — who the token represents, usually a user ID), aud (audience — intended recipient), exp (expiration time), iat (issued at), and nbf (not before).

Our parser decodes the Base64URL payload and displays all claims in a readable table. Unix timestamp claims (exp, iat, nbf) are converted to human-readable dates so you can immediately see when a token was issued and when it expires. Custom claims from your auth server are displayed alongside the standard ones.

This is invaluable when debugging auth issues: verify the sub matches the user you expect, check exp to see if the token is still valid, confirm aud matches your application's client ID, and inspect any role or permission claims your application depends on.

Tips

• exp and iat are Unix timestamps in seconds. JavaScript's Date uses milliseconds — multiply by 1000.
• sub (subject) is typically the user ID from your database. Use this to look up the user, not the email claim.
• aud validation is critical for security. Always verify the aud claim matches your application on the server.
• Custom claims added by your auth provider (roles, permissions, tenant ID) are in the payload just like standard claims.