ID Token Decoder
Decode OpenID Connect ID tokens to extract user identity information. ID tokens provide authenticated user details to client applications.
ID Token vs Access Token
| Feature | ID Token | Access Token | PurposeUser identityAPI authorization AudienceClient applicationResource server (API) ContentUser claims (name, email)Scopes and permissions FormatAlways JWTJWT or opaque SenderAlways to clientClient to API
Standard ID Token Claims
ClaimRequiredDescription issYesIssuer (OAuth server URL) subYesSubject (unique user ID) audYesAudience (your client ID) expYesExpiration time iatYesIssued at time auth_timeOptionalWhen user authenticated nonceConditionalReplay attack prevention acrOptionalAuthentication context class | amr | Optional | Authentication methods used |
ID Token Decoder
``javascript
function decodeIDToken(token) {
const parts = token.split('.');
if (parts.length !== 3) {
throw new Error('ID tokens must be JWTs');
}
const decode = (s) => JSON.parse(atob(s.replace(/-/g, '+').replace(/_/g, '/')));
const header = decode(parts[0]);
const payload = decode(parts[1]);
// Standard OIDC claims
const standardClaims = {
issuer: payload.iss,
subject: payload.sub,
audience: payload.aud,
expiresAt: new Date(payload.exp * 1000),
issuedAt: new Date(payload.iat * 1000),
authTime: payload.auth_time ? new Date(payload.auth_time * 1000) : null,
nonce: payload.nonce
};
// User profile claims
const profileClaims = {
name: payload.name,
email: payload.email,
emailVerified: payload.email_verified,
picture: payload.picture,
locale: payload.locale,
phone: payload.phone_number
};
// Provider-specific claims
const customClaims = {};
const knownClaims = ['iss', 'sub', 'aud', 'exp', 'iat', 'auth_time', 'nonce',
'name', 'email', 'email_verified', 'picture', 'locale', 'phone_number'];
for (const [key, value] of Object.entries(payload)) {
if (!knownClaims.includes(key)) {
customClaims[key] = value;
}
}
return {
header,
standardClaims,
profileClaims,
customClaims,
raw: payload
};
}
``
OIDC Profile Scopes
| Scope | Claims Included | openidsub (required for ID token) profilename, family_name, given_name, picture emailemail, email_verified addressaddress (formatted, street, city, etc.) phonephone_number, phone_number_verified