OneFreePlace — JWT Claims Inspector

JWT

Waiting

Top-level claims—

Deep paths—

Audience count—

Scopes—

Roles/groups—

Declared alg—

Claim semantics

Filter claims

Identity + access normalization

Identity

Authorization

Scopes

Roles / groups

Time claims

Token lifetime consumed (requires iat + exp)

Deep-path explorer

Filter paths

Audit

Claims are decoded locally. This tool does not establish signature authenticity, issuer trust, revocation state, or application acceptance.

Report

Claim policy

Use this as a diagnostic policy model after signature verification. Empty fields are ignored.

Expected issuer

Expected audience

Required scopes

Required roles/groups

Clock leeway (seconds)

Maximum token age (seconds)

Policy results

Token A

Token B

Added0

Removed0

Changed0

Unchanged0

Compared0

ModeDeep value

Diff

Decode is not verify

JWT claims can normally be read without a key. Treat decoded values as untrusted until the token's cryptographic protection and application-specific trust checks succeed.

Audience matters

Applications should check that they are an intended audience. A structurally valid token for another service should not be accepted just because its signature verifies.

Time claims

exp, nbf, iat and auth_time use NumericDate seconds. Leeway is an application policy for small clock differences, not a way to extend token lifetime broadly.

Scopes and roles

Scope and role conventions vary. This inspector normalizes common scope, scp, roles, role and groups representations for diagnostics.

Privacy signals

Signed JWT payloads are not secret by default. The privacy audit flags common identifying fields and claim names that look like credentials so they can be reviewed for data minimization.

Production acceptance

Use maintained libraries and validate signature, allowed algorithm, trusted issuer, intended audience, time claims, token type and protocol-specific requirements before authorizing access.