What is the difference between an id_token and an access token?

An id_token is proof of authentication, meant for your application to learn who the user is. An access token is authorization to call an API. Never send an id_token as a Bearer credential to a resource server.

Which claim should I use as the user identifier?

sub, combined with iss. It is the only claim guaranteed to be stable and unique. Email addresses change hands and can be unverified, so keying accounts on email invites account takeover.

What does the nonce claim do?

It echoes a random value your app generated for the login request, so a stolen id_token can't be replayed into a different session. Your app must compare it, not just read it.

Does this verify the token signature?

No — verification requires the provider's JWKS keys and must happen in your backend. This decoder shows you the contents so you can reason about them.

OpenID Connect (OIDC) Token Decoder

Decode OIDC id_tokens and read the standard identity claims they carry.

live · client-sideWeb, API & Tokensfree · no sign-up

RAW INPUT

DECODED

Output appears here as you type — decoded on your device.

Input is processed on your device. Nothing you paste is sent anywhere.

What is the OpenID Connect (OIDC) Token Decoder?

An OIDC token decoder decodes an OpenID Connect id_token — a JWT issued at login — to reveal the identity claims it asserts about the authenticated user, along with the nonce, audience and validity window.

OpenID Connect is the identity layer built on top of OAuth 2.0. Where an OAuth access token says what you may do, an OIDC id_token says who you are: it is always a JWT, and it carries a defined set of standard claims — sub (the stable user identifier), iss, aud, exp, iat, plus optional profile claims like email, email_verified, name, picture and locale.

Two claims exist purely for security. nonce binds the token to the specific authentication request your app started, defending against replay; and at_hash ties the id_token to the access token issued with it. auth_time and acr/amr tell you when and how the user actually authenticated, which matters for step-up flows.

Decode the token here to see all of it at once — particularly useful when a user 'logs in successfully' but your application creates the wrong account, which is nearly always a sub versus email identity mix-up.

OpenID Connect (OIDC) Token Decoder at a glance

Specification: OpenID Connect Core 1.0
Format: Always a JWT (unlike OAuth access tokens)
Stable user id: sub — unique per issuer, unlike email
Replay defence: nonce must match your auth request

How to use the OpenID Connect (OIDC) Token Decoder

1Paste the id_token returned from the token endpoint or the authorization response.
2Read the identity claims, with iat, auth_time and exp shown as human dates.
3Verify sub, aud and nonce match what your application expects.

When you would reach for it

Debugging why a social or enterprise login maps to the wrong user record.
Checking which profile claims an identity provider actually releases.
Confirming nonce and acr values while hardening an authentication flow.

OpenID Connect (OIDC) Token Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools