AWS Cognito JWT Decoder
Paste a Cognito access token or ID token to decode its claims — including token_use, cognito:groups, and the issuing User Pool. Verify the RS256 signature using your pool's JWKS URI.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding AWS Cognito JWTs
Amazon Cognito User Pools issue three types of tokens: an ID token, an access token, and a refresh token. The ID token and access token are both JWTs signed with RS256. The token_use claim is the easiest way to tell them apart: it is 'id' in an ID token and 'access' in an access token. Refresh tokens are opaque strings, not JWTs.
The Cognito JWKS endpoint follows a predictable pattern: https://cognito-idp.<region>.amazonaws.com/<userPoolId>/.well-known/jwks.json. The kid in the JWT header identifies which key in the JWKS was used to sign — look it up and paste the public key above to verify the signature. Key rotation is rare but Cognito does support it.
Cognito embeds Cognito-specific claims directly in the token payload. The cognito:groups claim lists the Cognito User Pool groups the user belongs to. The cognito:username is the pool-internal username (not necessarily the email). Paste a Cognito JWT above to decode these claims and inspect the full payload.
Common Cognito claims
issIssuer — the Cognito User Pool URL including region and pool ID.
e.g. https://cognito-idp.us-east-1.amazonaws.com/us-east-1_ABC
token_useDistinguishes access tokens ('access') from ID tokens ('id').
e.g. access
cognito:usernameThe username within the Cognito User Pool.
e.g. jane_doe
cognito:groupsList of Cognito groups the user belongs to.
e.g. ["Admins"]
client_idThe Cognito app client ID that the token was issued to.
e.g. abc123xyz
subImmutable unique identifier (UUID) for the user in the pool.
e.g. a1b2c3d4-...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.