JWT Claims Diff

About this tool

JWT Claims Diff decodes two compact JSON Web Tokens locally and compares the claims in their payloads. It shows which top-level claims were added, removed, or changed, how many stayed the same, and whether the tokens are claim-equivalent.

• Payload diff by default: sub, role, scope, exp, and other claims are compared at the top level.
• Optional header diff: include JOSE header changes such as alg, typ, or kid when you need to spot signing/configuration changes.
• Time claim annotations: numeric exp, nbf, and iat claims include a human-readable UTC timestamp; two exp claims also get a delta in seconds.
• Structured JSON output: use the report in scripts or copy it into a review.

No verification key is requested and signatures are not verified. This tool is for offline inspection and comparison only; use a JWT verification tool when you need to prove a token is authentic.

Worked example

Comparing an old token with role: "user" and scope: ["read"] to a new token with role: "admin", scope: ["read", "write"], and a new plan claim returns an excerpt like:

{
  "equal": false,
  "summary": { "added": 1, "removed": 0, "changed": 3, "unchanged": 3 },
  "payload": [
    { "claim": "role", "kind": "changed", "old": "user", "new": "admin" },
    { "claim": "scope", "kind": "changed", "old": ["read"], "new": ["read", "write"] },
    { "claim": "plan", "kind": "added", "new": "pro" }
  ]
}

Limits & edge cases

• Claims are compared top-level claim by top-level claim. Nested objects and arrays are shown as a whole changed value rather than a recursive JSON Patch.
• Tokens are decoded but not verified. A forged token can still be decoded and diffed.
• Encrypted JWT/JWE values are not supported; the input must be a readable compact JWT with JSON header and payload parts.
• Very large custom claims produce a correspondingly large JSON report.

FAQ