Contact

Tools  /  Security  /  JWT Claims Viewer

SECURITY

JWT Claims Viewer

Every payload claim annotated with what it actually means -- RFC 7519 registered claims, OIDC standard claims, and common Auth0/Firebase/Cognito/Azure AD platform claims -- plus a side-by-side diff between two tokens.

More Security tools

HTTP Security Header Reference Password Entropy Calculator Hash Generator Password Generator JWT Decoder & Generator HMAC Generator

What this tool does

Breaks a JWT's payload down claim by claim and annotates each one against known claim registries -- RFC 7519's registered claims, the OpenID Connect standard claims, and the common platform-specific claims used by Auth0, Firebase, AWS Cognito, and Azure AD -- so you can tell at a glance which claims are standard and which are custom to whatever issued the token. This is a focused, claims-semantics companion to this site's JWT Structure Viewer (security red flags) and JWT Expiration Checker (exp/nbf/iat timing) -- here specifically for understanding what every field in the payload is actually for.

Why claim provenance matters

A JWT payload is just a JSON object -- nothing in the format itself distinguishes a claim everyone agrees on the meaning of (like sub or email) from one a specific platform invented for its own purposes (like Cognito's cognito:groups or Azure AD's oid), from one an application added that means nothing outside that one system. Knowing which bucket a claim falls into matters for integration work -- a standard OIDC claim behaves the same way across providers, while a platform or custom claim only means what that specific issuer defined it to mean.

Namespaced custom claims

Because the JWT claim namespace is global and flat, adding a genuinely custom claim without colliding with a current or future registered or platform claim means namespacing it -- Auth0's own convention, for example, is prefixing custom claims with a URI the application controls, like https://yourapp.com/roles, rather than a bare roles that could collide with something else later. This tool flags any claim it doesn't recognize as custom, whether or not it's namespaced.

Comparing two tokens

Paste two tokens into the Compare tab to see every claim that was added, removed, or changed between them -- useful for understanding exactly what a refresh changed, or how two different services' tokens for the same user differ.

Privacy

Everything runs entirely in your browser. Nothing you paste here is sent anywhere.

FAQ

Frequently asked questions

Does this tool verify a JWT signature?
No. For signature verification use this site's JWT Decoder & Generator; for structural security red flags use the JWT Structure Viewer; for exp/nbf/iat timing use the JWT Expiration Checker. This tool is specifically for understanding what each payload claim means.
What makes a claim "standard" versus "custom"?
Standard claims are either RFC 7519's registered set (iss, sub, aud, exp, nbf, iat, jti) or the OpenID Connect standard claims (name, email, email_verified, picture, locale, and similar). Anything else -- including common platform claims like Cognito's cognito:groups or Azure AD's oid -- is specific to whichever system issued the token, not guaranteed by any spec.
Why should custom claims be namespaced?
The claim namespace is flat and global -- a bare claim name like roles could collide with a future standard claim or another system's convention. Prefixing custom claims with a URI your application controls (Auth0's documented approach) avoids that collision.
What does the Compare tab actually diff?
Every claim key present in either token: claims only in the first token, only in the second, and claims present in both but with different values -- so you can see exactly what changed between two tokens for the same subject.
Does this tool recognize Firebase, Cognito, or Azure AD claims specifically?
Yes -- in addition to RFC 7519 and OIDC standard claims, it recognizes common platform-specific claims from Auth0, Firebase, AWS Cognito, and Azure AD and annotates what each one typically means.
Is a claim being "unrecognized" a security problem?
No -- it just means this tool doesn't have that claim name in its reference list, which is completely normal for application-specific or newly namespaced claims. It's informational, not a warning.
Is anything I paste here sent anywhere?
No. Every decode and comparison runs entirely in your browser -- this tool has no server component.
Theme Accent