Apple Sign In ID Token Decoder
Paste an Apple Sign In identity_token to decode its stable user identifier, email (real or private relay), auth_time, and nonce. Verify the RS256 signature using Apple's public keys.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Apple Sign In ID Tokens
Apple Sign In issues ID tokens as RS256-signed JWTs after a user authenticates with their Apple ID. The token is returned as the identity_token field in the authorization response. Unlike many providers, Apple only returns the user's name and email in the authorization response the very first time a user signs in — subsequent sign-ins only provide the sub and core JWT claims.
The most important Apple-specific claim is sub — the stable, unique identifier for the Apple ID user within your app. This value never changes, even if the user changes their email address or name. Store sub immediately on first sign-in and use it as your primary key. Never rely on the email as a user identifier, since Apple allows users to use a private email relay that can change.
Apple publishes its public keys at https://appleid.apple.com/auth/keys. Match the kid in the JWT header to verify the RS256 signature. Also validate that iss is https://appleid.apple.com, aud matches your app's bundle ID, and the token is not expired. Paste your Apple ID token above to decode all claims.
Common Apple Sign In claims
issIssuer — always https://appleid.apple.com.
e.g. https://appleid.apple.com
subSubject — stable, unique Apple user identifier for your app. Never changes.
e.g. 000123.abc456def...
audAudience — your app's bundle ID or service ID.
e.g. com.yourcompany.yourapp
emailEmail — may be a private relay address if user chose to hide it.
e.g. xyz@privaterelay.appleid.com
is_private_emailWhether the email is an Apple private relay address.
e.g. true
auth_timeUnix timestamp of when the user was actually authenticated.
e.g. 1720000000
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.