Strong‐motion records from KiK‐net and K‐NET, along with 1 sample/s Global Positioning System (GPS) records from GEONET, were analyzed to determine the location, timing, and slip of subevents of the M 9 2011 Tohoku earthquake. Timing of arrivals on stations along the coast shows that the first subevent was located closer to the coast than subevent (2), which produced the largest slip. A waveform inversion of data from 0 to 0.2 Hz indicates that the first subevent primarily ruptured down‐dip and north of the hypocenter and had an M of 8.5. The areas of this subevent that generated the low (<0.2  Hz) and high (>0.2  Hz) frequency energy are located in the same vicinity. The inversion result for the second subevent (M 9.0) has large slip on the shallow part of the fault with peak slip of about 65 m above about 25 km depth. This slip generated the tsunami. The preferred inversion has initiation of subevent 2 on the shallow portion of the fault so that rupture proceeded down‐dip and mainly to the south. Subevent 2 started about 35 s after subevent 1, which allows for the possibility of dynamic triggering from subevent 1. The slip model predicts displacements comparable to those found from ocean‐bottom transducers near the epicenter. At frequencies that most affect tall buildings (0.1–0.5 Hz), there is a strong pulse (subevent 3) in the strong‐motion records that arrives after the near‐field ramp from subevent 2. High‐frequency subevent 3 was located down‐dip and south of the high‐slip portion of subevent 2 and was initiated as rupture from subevent 2 proceeded down‐dip. The compact pulse for subevent 3 is modeled with an M 8.0 source in a 75 by 30 km area that ruptured down‐dip and to the south with a high slip velocity, indicating high stress drop.