Decode and verify JSON Web Tokens with readable claims and Amazon Cognito checks, and encode or decode Base64 text and files — all in your browser.
Last updated
Token
Decoded in your browser — the token is not sent anywhere. Still, avoid pasting live production tokens into any website; use an expired or test token where you can.
Verify the signature
Decoded
Base64
Detects gzip (and decompresses it — handy for CloudWatch Logs and Kinesis payloads), images, PDF, ZIP and audio. Text is read as UTF-8.
Frequently asked questions
How do I decode a JWT?
A JWT has three Base64URL parts separated by dots: header, payload and signature. Paste the token above and the header and payload are decoded to JSON, with times such as exp and iat shown as dates. Decoding does not need the key; verifying the signature does.
Is it safe to paste a JWT into an online decoder?
This decoder runs entirely in your browser, so the token is not sent to a server. A JWT is a credential until it expires, though, so prefer expired or test tokens on any website and never share live tokens in tickets or chat.
How do I verify an Amazon Cognito token?
Cognito signs tokens with RS256. The public keys are at https://cognito-idp.REGION.amazonaws.com/USER_POOL_ID/.well-known/jwks.json. Download the JWKS (or press the button above), check the signature with the key whose kid matches the token, then check exp, iss, token_use and the aud (ID token) or client_id (access token).
What is the difference between a Cognito ID token and access token?
The ID token (token_use: id) describes the user — email, name, groups — and is meant for your app. The access token (token_use: access) carries scopes and is meant for APIs such as API Gateway. Access tokens have client_id instead of aud.
What is the difference between Base64 and Base64URL?
Base64URL replaces + with - and / with _ and usually drops the = padding, so the result is safe in URLs and HTTP headers. JWTs use Base64URL. This tool decodes both and can encode either.
Practical guide
Reading and verifying JWTs
A JSON Web Token has three Base64URL parts: a header (algorithm and key ID), a payload (claims about the user or client) and a signature. Anyone can decode the first two — only the signature proves who issued the token and that it wasn't changed.
Checks to make before trusting a token
The signature verifies with the issuer's public key (the JWK whose kid matches the header).
exp is in the future and nbf, if present, is in the past.
iss is the issuer you expect (for Cognito: https://cognito-idp.REGION.amazonaws.com/USER_POOL_ID).
The token is meant for you: aud for ID tokens, client_id for Cognito access tokens, and the right token_use.
The algorithm is the one you expect — never accept alg: none.
Typical AWS uses
Debugging a 401 from API Gateway with a Cognito or JWT authorizer.
Checking the groups and custom attributes in a Cognito ID token.
Inspecting tokens used for authenticated Amazon Connect chat or a customer-facing portal.
Base64
The Base64 tab encodes and decodes text and files, supports the URL-safe variant used in JWTs, and detects gzip, which is how CloudWatch Logs subscription data and many Kinesis payloads arrive.