JWT claims reference

Claims are the name/value pairs in a JWT payload. Seven are registered by RFC 7519; dozens more are standardized by OAuth 2.0 and OpenID Connect. Here is what each one means and how verifiers must treat it.

Registered claims (RFC 7519)

None of the registered claims is mandatory in general — each application profile decides which it requires. When present, they have fixed meanings:

Claim	Name	Meaning	Spec
iss	Issuer	Identifies the principal that issued the JWT.	RFC 7519 §4.1.1
sub	Subject	Identifies the principal that is the subject of the JWT, e.g. a user or service ID.	RFC 7519 §4.1.2
aud	Audience	Recipients the JWT is intended for. A string or an array of strings.	RFC 7519 §4.1.3
exp	Expires	Time on or after which the JWT must not be accepted (NumericDate, seconds since epoch).	RFC 7519 §4.1.4
nbf	Valid from	Time before which the JWT must not be accepted (NumericDate).	RFC 7519 §4.1.5
iat	Issued	Time at which the JWT was issued (NumericDate).	RFC 7519 §4.1.6
jti	JWT ID	Unique identifier for the JWT, useful to prevent replay.	RFC 7519 §4.1.7

How each claim is validated

iss — issuer

Compare with the exact issuer you trust, character for character. https://auth.example.com and https://auth.example.com/ are different issuers; the decoder points out trailing-slash and case mismatches.

aud — audience

May be a single string or an array. Your API must find its own identifier in it. Skipping the audience check lets a token minted for another service be replayed against yours.

exp, nbf, iat — time

NumericDate values in seconds. Reject when now ≥ exp or now < nbf, allowing a small clock tolerance. iat is informational, but an issue time in the future indicates clock skew.

{
  "iss": "https://auth.example.com/",
  "sub": "user-8127",
  "aud": ["api.example.com", "billing.example.com"],
  "iat": 1790602800,
  "nbf": 1790602800,
  "exp": 1790606400,
  "jti": "4f1c2d7e-9b3a-4c1e-8f5d-2a6b7c8d9e0f"
}

sub — subject

The principal the token is about. Unique within the issuer, so the pair (iss, sub) identifies a user globally. Don't use email addresses as subjects: they change.

jti — JWT ID

A unique identifier. Store recently seen values to reject replays of one-time tokens.

Common OAuth and OpenID Connect claims

Claim	Meaning	Defined in
azp	OAuth client the token was issued to (OIDC Core §2).	OIDC Core
scope	Space-separated OAuth scopes (RFC 8693 §4.2).	RFC 8693
scp	Scopes, commonly an array (vendor convention).	Convention
client_id	OAuth client identifier (RFC 9068).	RFC 9068
nonce	Value binding an ID token to a client session (OIDC).	OIDC Core
auth_time	When the end-user authenticated (NumericDate).	OIDC Core
acr	Authentication Context Class Reference.	OIDC Core
amr	Authentication methods used, e.g. pwd, mfa.	RFC 8176
sid	Session identifier (OIDC Front/Back-Channel Logout).	OIDC
email	End-user email address.	OIDC Core
email_verified	Whether the email address was verified.	OIDC Core
name	End-user full name.	OIDC Core
roles	Role names (RFC 7643 / RFC 9068).	RFC 9068
groups	Group memberships (RFC 9068).	RFC 9068
cnf	Proof-of-possession key binding (RFC 7800).	RFC 7800

Custom claims

Anything else is a private claim. To avoid collisions, namespace them (https://example.com/roles or example_roles) or register them with IANA. Remember that the payload is readable by anyone holding the token — never put passwords, API keys or personal data you wouldn't show the user into it.

Paste a JWT to see every claim explained, with timestamps converted and invalid types flagged.

Analyze a token's claims