Okta JWT Decoder
Paste an Okta access token or ID token to decode its claims — including client ID, user ID, granted scopes, and groups. Verify the RS256 signature using your authorization server's JWKS.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Okta JWTs
Okta issues JWTs from two types of authorization servers: the Org Authorization Server (for Okta API access) and Custom Authorization Servers (for your own APIs). Custom authorization servers are the recommended approach for new applications — they let you configure scopes, claims, and policies independently. The iss claim indicates which server issued the token.
Okta tokens are signed with RS256. Each authorization server exposes a JWKS endpoint you can find in its OpenID Connect metadata: https://<your-okta-domain>/oauth2/<authServerId>/.well-known/openid-configuration. The default authorization server uses 'default' as the server ID. Fetch the public key matching the kid in the JWT header to verify the signature.
Two Okta-specific claims are particularly useful: cid is the client ID of the application that requested the token, and uid is the Okta user ID of the authenticated user. The groups claim (if configured in the authorization server) lists the Okta groups the user belongs to. Paste your Okta JWT above to decode all of these instantly.
Common Okta claims
issIssuer — the Okta authorization server URL.
e.g. https://dev-123.okta.com/oauth2/default
cidClient ID — the Okta application that requested this token.
e.g. 0oa1b2c3d4e5...
uidUser ID — the Okta internal user identifier.
e.g. 00u1a2b3c4d5...
scpScopes granted to this token.
e.g. ["openid","profile"]
groupsOkta groups the user belongs to (if claim is configured).
e.g. ["Everyone","Admins"]
subSubject — defaults to the Okta username or email.
e.g. jane.doe@example.com
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.