OIDC Token Decoder - Decode OpenID Connect ID Tokens

Decode OpenID Connect ID tokens to view claims, verify expiration, check issuer and audience. Supports Auth0, Okta, Azure AD. Browser-based, private tool.

ID Token (JWT)

Paste the full JWT token with three parts separated by dots

Token Status

Paste an ID token to decode

Token claims will appear here

Token header will appear here

Header (Base64)

Payload (Base64)

Signature (Base64)

OAuth Token Decoder - Inspect Access & R…

View all Oauth decoders →

Frequently Asked Questions

An ID token is a JWT that contains user identity claims. Unlike access tokens (for APIs), ID tokens prove user authentication to the client application. They include user profile info, issuer, and expiration.

ID tokens contain user identity info for the client app. Access tokens authorize API calls. Both are JWTs but serve different purposes: authentication (ID) vs authorization (access).

Standard claims: iss (issuer), sub (user ID), aud (client ID), exp (expiration), iat (issued at), nonce, auth_time. Custom claims: name, email, picture, groups, roles.

This tool decodes and displays token contents but doesn't cryptographically verify signatures. Verification requires the issuer's public key (JWKS endpoint) which apps handle server-side.

All decoding happens locally in your browser. Tokens never leave your machine. However, avoid pasting production tokens on public computers or screensharing during debugging.

Nonce prevents replay attacks. The client generates a random value, includes it in the auth request, and verifies it matches in the ID token. Ensures tokens aren't reused maliciously.

iat (issued at) is the creation timestamp. exp (expiration) is when the token becomes invalid. The difference determines token lifetime, typically 1 hour for ID tokens.

Auth0, Okta, Azure AD, Google, Keycloak, AWS Cognito, and any OAuth 2.0 provider supporting OpenID Connect. All use the standard JWT format with provider-specific claims.

at_hash is a hash of the access token. When both ID and access tokens are issued together, this claim links them and prevents token substitution attacks.

No. Applications must reject expired tokens even if the signature is valid. The exp claim is critical for security. Use refresh tokens to obtain new ID tokens after expiration.

Related Tools