JWT Audience Validator
The JWT Audience Validator checks whether the aud claim of your token matches the audience you expect — whether the token carries a single audience string or an array of them.
What This Tool Does
The aud (audience) claim identifies the recipients a token is intended for. A service should reject any token whose aud does not identify that service. This tool decodes the payload, extracts aud — string or array — and reports whether your expected value is present.
How to Use
- Paste your JWT into the input field.
- Enter the expected audience (for example your API identifier) in the audience field.
- Read the verdict: audience matched or mismatched.
- Use Sample Data to see a working example.
Key Features
- Validates string and array aud claims
- Exact-match comparison against your expected value
- Clear reporting when the aud claim is absent
- Sample token and audience included
- Copy, download and reset actions
- Runs entirely in your browser
Common Use Cases
- Confirming a token was issued for your API and not another service
- Debugging audience-mismatch rejections from your resource server
- Testing multi-audience tokens during integration
- Verifying issuer configuration after changing the registered audience
- Learning how audience restriction works in OAuth 2.0 and OpenID Connect
Why Audience Validation Matters
Without audience checks, a token minted for one service could be replayed against another. Validating aud ensures the token was intended for the service that is consuming it.
aud may be a single string or an array; validators should accept the token only when their own identifier appears among the values.
Frequently Asked Questions
What is the aud claim?
aud identifies the intended recipients of the token — typically an API identifier or client ID. Consumers should reject tokens whose aud does not name them.
Can aud contain multiple values?
Yes. RFC 7519 allows aud to be an array of strings; the token is valid for you if your identifier is one of them.
What happens if the token has no aud claim?
The tool reports it as missing. Whether that is acceptable depends on your security policy — many systems require an audience.
Is the comparison case-sensitive?
Yes, audience values are compared exactly, including case and trailing slashes — a common source of mismatches.
Does a matching audience make the token valid?
It is one required check among several: signature, expiration, issuer and not-before should also be validated.
Is my token or audience sent anywhere?
No. The comparison runs locally in your browser.
Related JWT Tools
- JWT Claims Viewer — View all JWT claims in a tree-style format
- JWT Inspector — Comprehensive analysis of JWT token structure and claims
- JWT Expiry Checker — Check if JWT token is expired and view time remaining
- JWT Decoder — Decode JWT tokens to view header and payload