JWT Missing sub Claim – Inspect a Token Without Subject

Local only

Inspect a valid JWT payload with issuer and audience metadata but no subject claim.

121 chars · 1 line

141 chars · 10 lines

Algorithm: HS256Signature not verifiedTime status: Not evaluated (no numeric exp/nbf)

JWT identity-claim troubleshooting

What a missing JWT sub claim means

A JWT can decode successfully without sub. Whether that is acceptable depends on the token's purpose: some machine-to-machine tokens do not identify an end user, while user tokens often rely on a stable subject identifier. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-local JWT decoding
  • Strict three-segment validation
  • Canonical Base64URL checks
  • Header and payload JSON validation
  • Expiration status details
  • No signature verification claims

Steps

  1. Confirm sub is absent rather than empty or renamed.
  2. Check whether the token represents a user, service, or another principal type.
  3. Enforce the required identity claims in the trusted consuming application.

Not every JWT carries the same identity claims

JWT is a container format used by multiple token profiles. The consuming system defines which claims are mandatory for its authorization model.

Payload without subject

Issuer and audience metadata exist, but there is no sub field.

Decoded payload

{"iss":"https://issuer.example","aud":"api://orders"}

Interpretation

No subject identifier is present; policy decides whether one is required.

Common questions

Frequently asked questions

Is sub required in every JWT?

No. Requirements depend on the JWT profile and application contract.

Can another claim identify the principal?

Some profiles define other identifiers, but your consumer should follow its documented contract.

Does this decoder infer a subject from another claim?

No. It preserves the payload as issued.

Recommended next steps

JWT Missing iss ClaimInspect a token with no issuer claim and keep issuer validation separate from decoding.JWT Missing aud ClaimInspect a decoded JWT that omits audience information required by some verifiers.JWT Decoder OnlineDecode JWT header and payload data locally in the browser.

Debugging a specific JWT issue? Browse JWT troubleshooting.