OIDC ID Token Decoder
Paste an OpenID Connect ID token to decode its identity claims — sub, name, email, email_verified, picture, and more. Verify the signature client-side using the provider's JWKS.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What is an OpenID Connect ID token?
An ID token is a JWT issued by an OpenID Connect provider after a user successfully authenticates. Unlike access tokens (which authorize API calls), ID tokens represent the user's identity — they are meant to be consumed by the client application to know who the user is. The ID token payload contains claims about the user like their unique identifier (sub), name, email, and profile picture URL.
ID tokens are signed (usually RS256) by the identity provider, allowing the client application to verify their authenticity without contacting the server again. Standard OIDC claims defined in the spec include sub, name, given_name, family_name, email, email_verified, picture, locale, and updated_at. The aud claim in an ID token is the client ID of the application that requested it.
Never send ID tokens to APIs — they are not access tokens and APIs should not accept them for authorization. Use the ID token in your frontend to display user information and derive user identity. Paste your ID token above to decode all OIDC claims and see expiry status.
Standard OIDC ID token claims
subSubject — stable unique identifier for the user at this provider.
e.g. 110248...
nameThe user's full name as provided by the identity provider.
e.g. Jane Doe
emailThe user's email address.
e.g. jane@example.com
email_verifiedWhether the email address has been verified by the provider.
e.g. true
pictureURL of the user's profile picture.
e.g. https://...
nonceValue to mitigate replay attacks — must match what your app sent.
e.g. abc123xyz
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.