# JWT decoder: read the claims behind your RLS.

Decode a test JWT and understand Supabase claims, timestamps and RLS helpers. The token stays in your browser — free, no sign-up. Never paste a service_role token here or on any website.

Page: https://saascode.ai/tools/jwt-decoder

## How to use

1. Use a disposable test user token. Never paste a service_role key or another privileged credential.
2. Choose Decode JWT to inspect the header, payload, expiry and claim explanations.
3. Compare the sub and claims with what a verified request would expose to auth.uid() and auth.jwt(). Clear the token when finished.

## Scope

Decoded, not verified. No token, decoded claim or result is included in tool analytics.

## References

- [Supabase JWT claims](https://supabase.com/docs/guides/auth/jwt-fields)
- [Supabase RLS helpers](https://supabase.com/docs/guides/database/postgres/row-level-security)

## Build your SaaS

[Explore SaaSCode Base and its RLS foundation](https://saascode.ai/free)

## Related tools

- [PostgreSQL SQL formatter](https://saascode.ai/tools/sql-formatter)
- [Next.js env & secrets generator](https://saascode.ai/tools/env-generator)
- [Supabase pricing calculator](https://saascode.ai/tools/supabase-pricing-calculator)
- [All free tools](https://saascode.ai/tools)

## FAQ

### Is this free, and do I need an account?

It is free, no sign-up. Processing happens in your browser. Tool inputs and results are not sent to a processing API or saved by this tool. Usage analytics record only the tool name and action.

### Does decoding verify the JWT signature?

No. Anyone can construct these claims. Decoding proves neither authenticity nor access. Verify signatures, issuer, audience and expiry in your application before trusting a token.

### What do role, aal and amr mean in Supabase?

role selects the database role, often anon or authenticated. aal is the authentication assurance level: aal1 for a single factor, aal2 after MFA. amr lists the authentication methods and their timestamps.

### What do auth.uid() and auth.jwt() see in RLS?

For an accepted request, auth.uid() reads the UUID in sub; without an authenticated user it returns null. auth.jwt() exposes the request claims. This preview shows decoded values, not a live database session or a permission decision.

### Is user_metadata safe for authorization?

No. Users can update their own user_metadata. app_metadata is controlled by your backend and is more appropriate for authorization data, but JWT claims can be stale until a token is refreshed.

### What happens if the token expired or uses service_role?

exp is compared to your browser clock and an expired token is flagged; iat shows when it was issued. A service_role payload is blocked and the input is cleared. This role can bypass RLS: keep it on trusted servers and rotate it if exposed.