SecOps Tools · Identity & Token Analysis

TokenDecoder

Decode and inspect JWT, SAML, and OIDC tokens — claims with plain-English annotations, expiry and security risk flags, and JWKS signature verification for RS256/ES256. Everything runs in your browser; tokens are never transmitted.

100% client-side · no token leaves your browser

0 chars

A private JWT, SAML & OIDC token decoder

TokenDecoder is a free, browser-based inspector for the three token formats that show up in modern single sign-on: JSON Web Tokens (JWT), SAML responses, and OpenID Connect (OIDC) access and ID tokens. Unlike tools that POST your token to a backend, every step here — Base64url decoding, claim parsing, expiry checks, and even cryptographic signature verification — runs locally in your browser using native JavaScript and the Web Crypto API. Your token is never sent anywhere.

Decode a JWT and read its claims

Paste a JWT and TokenDecoder splits it into header, payload, and signature, decodes each Base64url segment, and renders the claims as a readable table. Standard registered claims (iss, sub, aud, exp, nbf, iat, jti) are annotated in plain English, and epoch timestamps are converted to human-readable UTC so you can immediately see when a token was issued and when it expires.

Verify the signature against the issuer's JWKS

For asymmetric algorithms (RS256/384/512, ES256/384), TokenDecoder derives the JWKS endpoint from the iss claim's OpenID configuration, fetches the matching public key by kid, and verifies the signature in-browser. Only the public key is retrieved — the token itself stays local. HMAC tokens (HS256) can't be verified without the shared secret, and a token using alg: none is flagged as a critical risk and never "verified".

Inspect SAML responses and OIDC tokens

Switch to the SAML tab to decode a Base64 (or DEFLATE-compressed) SAML response and pull out the issuer, status, subject NameID, conditions window, audience restriction, authentication context, and every attribute statement. OIDC tokens are decoded as JWTs but annotated with OIDC-specific claims (nonce, at_hash, auth_time, acr, amr, azp) and summarized in a dedicated card showing identity, scopes, validity, and whether MFA was used.

Frequently asked questions

Yes. TokenDecoder decodes tokens entirely in your browser using native JavaScript and the Web Crypto API. The token is never sent to any server. Signature verification fetches only the issuer's public JWKS keys — never the token itself.
Paste the JWT and TokenDecoder converts the exp claim to a human-readable UTC time. If the expiry is in the past, it shows a HIGH-severity "Token is expired" flag in the Security Analysis panel.
Yes, for RS256/384/512 and ES256/384 it fetches the issuer's JWKS (from the iss claim's OpenID configuration), matches the key by kid, and verifies the signature with the Web Crypto API. HS256 cannot be verified without the shared secret, and alg:none is flagged as a critical risk.
Yes. It Base64-decodes (and DEFLATE-inflates, for HTTP-Redirect binding) the SAML XML, then extracts the issuer, status, subject NameID, conditions, audience, AuthnContext, and attribute statements. Note that client-side XML signature verification is out of scope.
An OIDC access or ID token is structurally a JWT. TokenDecoder decodes it with the same pipeline but annotates OIDC-specific claims such as nonce, at_hash, auth_time, acr, amr, and azp, and shows an OIDC summary card.
RegEx Lab → Regex tester with ReDoS detector & security patterns WinEvents → Windows Event ID lookup with MITRE ATT&CK mappings KQL Builder → Sentinel & Defender XDR query builder