JWT decoder: read the claims behind your RLS.
Decode a test JWT and understand Supabase claims, timestamps and RLS helpers. The token stays in your browser — free, no sign-up. Never paste a service_role token here or on any website.
Loading the tool…
Decoded, not verified. No token, decoded claim or result is included in tool analytics.
How to use
- Use a disposable test user token. Never paste a service_role key or another privileged credential.
- Choose Decode JWT to inspect the header, payload, expiry and claim explanations.
- Compare the sub and claims with what a verified request would expose to auth.uid() and auth.jwt(). Clear the token when finished.
Reference documentation
Frequently asked questions
Is this free, and do I need an account?
It is free, no sign-up. Processing happens in your browser. Tool inputs and results are not sent to a processing API or saved by this tool. Usage analytics record only the tool name and action.
Does decoding verify the JWT signature?
No. Anyone can construct these claims. Decoding proves neither authenticity nor access. Verify signatures, issuer, audience and expiry in your application before trusting a token.
What do role, aal and amr mean in Supabase?
role selects the database role, often anon or authenticated. aal is the authentication assurance level: aal1 for a single factor, aal2 after MFA. amr lists the authentication methods and their timestamps.
What do auth.uid() and auth.jwt() see in RLS?
For an accepted request, auth.uid() reads the UUID in sub; without an authenticated user it returns null. auth.jwt() exposes the request claims. This preview shows decoded values, not a live database session or a permission decision.
Is user_metadata safe for authorization?
No. Users can update their own user_metadata. app_metadata is controlled by your backend and is more appropriate for authorization data, but JWT claims can be stale until a token is refreshed.
What happens if the token expired or uses service_role?
exp is compared to your browser clock and an expired token is flagged; iat shows when it was issued. A service_role payload is blocked and the input is cleared. This role can bypass RLS: keep it on trusted servers and rotate it if exposed.
Related tools
All free toolsPostgreSQL SQL formatter
Format PostgreSQL queries, Supabase policies and PL/pgSQL function definitions locally. Check basic syntax without running SQL. Free, no sign-up.
Next.js env & secrets generator
Generate browser-random secrets and a Next.js env template for Supabase and Stripe. Separate NEXT_PUBLIC_ values from server secrets. Free, no sign-up.
Supabase pricing calculator
Estimate Supabase monthly costs for MAU, database, storage, egress, edge functions and compute. Compare dated Free, Pro and Team rates. Free, no sign-up.