OpenID Connect Token Decoder
Paste an OpenID Connect ID token to decode its identity claims — sub, email, name, and more. Verify the RS256 signature using the provider's JWKS. Everything runs in your browser.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What is OpenID Connect (OIDC)?
OpenID Connect (OIDC) is an identity authentication layer built on top of OAuth 2.0. It adds a standardized ID token — a JWT that carries verified identity claims about the authenticated user. OIDC is the standard used by virtually all major identity providers: Google, Microsoft, Apple, Auth0, Okta, Cognito, Keycloak, and more. It gives you a consistent way to authenticate users regardless of which provider they use.
After a user authenticates through an OIDC flow, the client application receives an ID token (and optionally an access token). The ID token contains the user's sub (stable unique identifier), along with profile claims the user consented to share. The client verifies the ID token's signature, confirms the iss, aud, and exp claims, and then trusts the identity data inside.
OIDC also defines standard discovery metadata at /.well-known/openid-configuration — a JSON document that lists the provider's endpoints (authorization, token, userinfo, JWKS) and supported algorithms. Paste your OIDC ID token above to decode all claims instantly and verify the signature.
Standard OIDC claims
subSubject — the stable unique user identifier at this provider.
e.g. auth0|abc123
issIssuer — the OIDC provider's URL.
e.g. https://accounts.google.com
audAudience — your application's client ID.
e.g. your-client-id
iatIssued at — Unix timestamp when the token was created.
e.g. 1720000000
expExpiration — Unix timestamp when the token expires.
e.g. 1720003600
at_hashAccess token hash — cryptographically links ID token to access token.
e.g. HK6E_P6Dh8Y...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.