Pawan Kumar
jwt · oauth 2.0 · openid connect

Read what is inside a <token>.

Three base64url chunks separated by dots: a header, a set of claims, a signature. Decoded here, with the timestamps in words — and without the token ever leaving your machine.

Token

Paste a token above, or to see the shape of one.

What the registered claims mean

issIssuer — who minted the token.
subSubject — who or what it is about, usually a user id.
audAudience — who is meant to accept it. Check this.
expExpiry. Seconds since the epoch, not milliseconds.
nbfNot before — reject the token until this moment.
iatIssued at. Useful for a maximum-age policy.
jtiToken id — the handle for replay detection or revocation.
scopeOAuth 2.0 permissions, space separated.
azpAuthorised party — the client the token was issued to.
nonceBinds an OIDC id token to your original request.
auth_timeWhen the user actually authenticated, not when this was minted.
kidHeader, not payload: which key from the JWKS signed it.