Ping Identity JWT Decoder
Paste a PingOne access token or ID token to decode its environment ID, region, client ID, and attribute-mapped claims. Verify the RS256 signature using your environment's JWKS.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Ping Identity JWTs
PingOne is Ping Identity's cloud identity platform. It issues OAuth 2.0 / OIDC tokens as JWTs signed with RS256. PingOne organizes resources within environments — each environment has its own tenant, users, applications, and signing keys. The env claim in the JWT identifies the specific PingOne environment that issued it.
PingOne's JWKS endpoint follows the pattern https://auth.pingone.<region>/v1/environments/<environmentId>/keys. The p1.region claim (or the domain pattern in iss) tells you which regional instance (NA, EU, APAC, CA) issued the token. Match the kid in the JWT header to the correct public key in the JWKS to verify the signature.
PingOne supports rich attribute mapping — user directory attributes can be mapped into JWT claims via Application attribute mappings in the console. Custom attributes from the PingOne user schema appear as top-level claims in the access token or ID token. Paste a PingOne JWT above to decode the full payload.
Common PingOne claims
issIssuer — the PingOne authorization server URL for your environment.
e.g. https://auth.pingone.com/env123.../as
envPingOne environment ID — identifies the issuing environment.
e.g. a1b2c3d4-...
client_idThe PingOne application (client) that requested the token.
e.g. app_xyz...
subSubject — the PingOne user's unique identifier.
e.g. user_abc...
p1.regionPingOne regional instance: NA, EU, APAC, or CA.
e.g. NA
orgThe PingOne organization associated with the environment.
e.g. org_xyz...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.