Firebase ID Token Decoder
Paste a Firebase ID token to decode its claims — including sign-in provider, email verification status, and custom claims set via the Admin SDK. Verify the RS256 signature client-side.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Firebase ID Tokens
Firebase Authentication issues ID tokens as signed JWTs whenever a user signs in. These tokens identify the authenticated user and are meant to be sent to your backend, which verifies them using the Firebase Admin SDK or directly via Google's public keys. They expire after one hour and are refreshed automatically by the Firebase SDK on the client.
Firebase ID tokens are signed with RS256. Google publishes the signing certificates at https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com. The kid in the JWT header tells you which certificate to use for verification. The iss claim is always https://securetoken.google.com/<projectId>.
The firebase.sign_in_provider claim inside the nested firebase object tells you how the user authenticated — google.com, password, phone, github.com, etc. Custom claims set via the Admin SDK appear as top-level claims in the payload. Paste your Firebase ID token above to decode and inspect all of this.
Common Firebase claims
issIssuer — always the securetoken.google.com URL for your project.
e.g. https://securetoken.google.com/my-project
audAudience — your Firebase project ID.
e.g. my-firebase-project
subSubject — the Firebase user UID (same as uid claim).
e.g. uid_abc123...
email_verifiedWhether the user's email address has been verified.
e.g. true
firebase.sign_in_providerThe sign-in method used: password, google.com, phone, etc.
e.g. google.com
firebase.identitiesMap of federated identities linked to this user account.
e.g. {"google.com":["..."]}
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.