What are JWT claims?
Claims are the statements in the payload of a token. Some names are registered in the JWT standard and have fixed meanings. Others are public, shared by a protocol such as OpenID Connect, or private to your own application.
Registered claims
- iss the issuer that created the token.
- sub the subject, usually a user ID.
- aud the audience, which can be one value or a list.
- exp the time after which the token must be rejected.
- nbf the time before which it must be rejected.
- iat when the token was issued.
- jti a unique token ID.
Common claims from providers
Identity providers add claims such as scope, roles, groups, email, name and azp. The table explains the common ones and marks the rest as custom.
Times are numbers
The time claims are Unix timestamps in seconds since 1 January 1970 UTC. This page shows each one as a date and as a distance from now. If a value looks like milliseconds, you are told.
What to check on the receiving side
A receiver should check the signature first, then exp, nbf, iss and aud. Never trust a claim from a token whose signature has not been verified. Try this on the JWT decoder, test dates with the expiration checker, or build your own claims with the claims builder. See also what a JWT is.