Auth0 JWT Decoder
Paste an Auth0 access token or ID token to inspect its header, payload, and claims — including scope, permissions, and custom namespace claims. Verify the RS256 signature privately, client-side.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Auth0 JWTs
Auth0 issues two types of JWTs: access tokens and ID tokens. Access tokens are sent in the Authorization header to authorize API calls. ID tokens carry identity information about the logged-in user and are consumed by your frontend application. Both are signed JSON Web Tokens, but their audiences and intended recipients differ — the aud claim tells you which is which.
Auth0 signs most tokens with RS256, using a private key held by Auth0 and a public key published at your tenant's JWKS endpoint: https://<your-tenant>.auth0.com/.well-known/jwks.json. Because verification uses a public key, your backend APIs can verify tokens independently without sharing any secret. The kid in the JWT header tells you which key from the JWKS to use.
Custom claims must be namespaced with a URL to avoid collisions with standard OIDC claims — for example https://myapp.com/roles. Paste your Auth0 token above to instantly decode its header and payload, inspect scope and permissions, and verify the RS256 signature by pasting the public key from the JWKS.
Common Auth0 claims
issIssuer — your Auth0 tenant domain URL.
e.g. https://tenant.auth0.com/
subSubject — the unique Auth0 user identifier.
e.g. auth0|60d3b...
audAudience — the API identifier or client ID this token is for.
e.g. https://api.example.com
azpAuthorized party — the client application that requested the token.
e.g. abc123clientId
scopeSpace-separated list of OAuth scopes granted to this token.
e.g. openid profile email
permissionsRBAC permissions granted via Auth0 roles — only on access tokens.
e.g. ["read:users"]
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.