Keycloak JWT Decoder
Paste a Keycloak access token to decode its realm roles, client roles, preferred username, and all standard claims. Verify the RS256 signature using your realm's public key.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Keycloak JWTs
Keycloak is an open-source identity provider that issues access tokens and ID tokens for realms — logical namespaces grouping users, clients, and roles. Keycloak access tokens are rich JWTs that embed both realm-level and client-level roles directly in the payload, making authorization decisions possible without a database lookup.
The realm_access.roles array contains roles assigned at the realm level (available across all clients). The resource_access object contains client-specific role assignments — keyed by client ID, each entry has its own roles array. This means a single Keycloak token can carry authorization data for multiple microservices simultaneously.
Keycloak signs tokens with RS256 by default. Each realm's public key is available at https://<keycloak-host>/realms/<realm-name>/protocol/openid-connect/certs — this is the JWKS endpoint. Paste your Keycloak access token above to decode the full payload and verify the signature.
Common Keycloak claims
issIssuer — the Keycloak realm URL.
e.g. https://auth.example.com/realms/myrealm
realm_access.rolesRealm-level roles assigned to this user.
e.g. ["user","admin"]
resource_accessClient-level roles, keyed by client ID.
e.g. {"my-app":{"roles":["editor"]}}
preferred_usernameThe user's username within the Keycloak realm.
e.g. jane_doe
azpAuthorized party — the Keycloak client that requested the token.
e.g. my-frontend-app
session_stateKeycloak session ID — useful for logout and session management.
e.g. abc123...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.