ID Token Decoder
Decode OpenID Connect ID tokens to extract user identity information. ID tokens provide authenticated user details to client applications.
ID Token vs Access Token
| Feature | ID Token | Access Token |
|---|---|---|
| Purpose | User identity | API authorization |
| Audience | Client application | Resource server (API) |
| Content | User claims (name, email) | Scopes and permissions |
| Format | Always JWT | JWT or opaque |
| Sender | Always to client | Client to API |
Standard ID Token Claims
| Claim | Required | Description |
|---|---|---|
| iss | Yes | Issuer (OAuth server URL) |
| sub | Yes | Subject (unique user ID) |
| aud | Yes | Audience (your client ID) |
| exp | Yes | Expiration time |
| iat | Yes | Issued at time |
| auth_time | Optional | When user authenticated |
| nonce | Conditional | Replay attack prevention |
| acr | Optional | Authentication context class |
| amr | Optional | Authentication methods used |
ID Token Decoder
``javascript
function decodeIDToken(token) {
const parts = token.split('.');
if (parts.length !== 3) {
throw new Error('ID tokens must be JWTs');
}
const decode = (s) => JSON.parse(atob(s.replace(/-/g, '+').replace(/_/g, '/')));
const header = decode(parts[0]);
const payload = decode(parts[1]);
// Standard OIDC claims
const standardClaims = {
issuer: payload.iss,
subject: payload.sub,
audience: payload.aud,
expiresAt: new Date(payload.exp * 1000),
issuedAt: new Date(payload.iat * 1000),
authTime: payload.auth_time ? new Date(payload.auth_time * 1000) : null,
nonce: payload.nonce
};
// User profile claims
const profileClaims = {
name: payload.name,
email: payload.email,
emailVerified: payload.email_verified,
picture: payload.picture,
locale: payload.locale,
phone: payload.phone_number
};
// Provider-specific claims
const customClaims = {};
const knownClaims = ['iss', 'sub', 'aud', 'exp', 'iat', 'auth_time', 'nonce',
'name', 'email', 'email_verified', 'picture', 'locale', 'phone_number'];
for (const [key, value] of Object.entries(payload)) {
if (!knownClaims.includes(key)) {
customClaims[key] = value;
}
}
return {
header,
standardClaims,
profileClaims,
customClaims,
raw: payload
};
}
``
OIDC Profile Scopes
| Scope | Claims Included |
|---|---|
| openid | sub (required for ID token) |
| profile | name, family_name, given_name, picture |
| email, email_verified | |
| address | address (formatted, street, city, etc.) |
| phone | phone_number, phone_number_verified |