Google OAuth / ID Token Decoder
Paste a Google ID token to decode its claims — including email, profile, hosted domain (hd), and the stable user identifier (sub). Verify the RS256 signature using Google's JWKS.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Google OAuth JWTs
Google issues two types of tokens in an OAuth 2.0 flow: the ID token and the access token. The ID token is always a JWT and carries identity claims about the authenticated user. The access token, by contrast, is an opaque string (not a JWT) used to call Google APIs — you cannot meaningfully decode it as a JWT. Always use the ID token when you need to know who the user is.
Google ID tokens are signed with RS256. Google publishes its public keys at https://www.googleapis.com/oauth2/v3/certs (JWK format) or https://www.googleapis.com/oauth2/v1/certs (X.509 format). Match the kid in the JWT header to the correct key, then verify the signature. You should also confirm iss is accounts.google.com and aud matches your OAuth client ID.
The hd claim is especially useful for applications restricted to Google Workspace (formerly G Suite) domains — it contains the hosted domain like company.com. Always validate hd server-side if your app is meant only for users from a specific organization. Paste your Google ID token above to decode all claims and verify the signature.
Common Google ID token claims
issIssuer — always accounts.google.com for Google ID tokens.
e.g. accounts.google.com
subSubject — stable, unique Google account ID. Use as your user key.
e.g. 110248495921279547550
audAudience — your OAuth 2.0 client ID. Must match your app.
e.g. 1234567890.apps.googleusercontent.com
email_verifiedWhether the email address has been verified by Google.
e.g. true
hdHosted domain — present for Google Workspace accounts.
e.g. yourcompany.com
at_hashAccess token hash — links the ID token to the access token.
e.g. HK6E_P6Dh8Y93mRNtsDB1Q
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.