JWT aud String vs Array – Understand Audience Claim Shapes

Local only

Inspect the standard string-or-array audience claim without treating either valid shape as a decoder error.

117 chars · 1 line

157 chars · 13 lines

Algorithm: HS256Signature not verifiedTime status: Not evaluated (no numeric exp/nbf)

JWT audience troubleshooting

How to read a JWT aud claim that is a string or an array

JWT audience data can represent one intended recipient or multiple recipients. The decoder preserves the JSON shape it receives; deciding whether your service is an allowed audience belongs to trusted verifier policy. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Decode the payload and inspect aud without coercing its type.
  2. Compare each audience value with the identifier expected by your API.
  3. Perform audience validation only after signature and issuer verification.

Decoding preserves audience shape

A local decoder can show whether aud is one string or an array of strings. It cannot know which audience identifier your service trusts.

Multiple audiences

The example payload targets two audience identifiers.

Decoded claim

"aud":["api://orders","api://admin"]

Meaning

Two declared audiences; verifier policy decides whether either is acceptable.

Common questions

Frequently asked questions

Is an aud array automatically invalid?

No. Audience validation must account for the claim shape used by the issuer.

Does decoding prove my API is an audience?

No. The decoder only exposes token-controlled data.

Should I convert arrays to one string?

No. Preserve the issuer's claim shape and apply explicit audience validation.

Recommended next steps

JWT Missing aud ClaimInspect a decoded JWT that omits audience information required by some verifiers.JWT Signature Not VerifiedUnderstand why decoding JWT claims does not authenticate the token.JWT Decoder OnlineDecode JWT header and payload data locally in the browser.

Debugging a specific JWT issue? Browse JWT troubleshooting.