OIDC ID Token Validator
Check OIDC ID token claims including nonce, auth_time, and at_hash without uploading tokens to a server.
Validate OpenID Connect ID token claims locally
An ID token is a JWT returned by the token endpoint in OpenID Connect flows. It
carries identity claims such as iss, sub, aud,
exp, and iat, plus flow-specific values like nonce and
at_hash. This tool checks those registered and OIDC-specific claims against your
expected issuer, audience, and nonce. It can also recompute at_hash from an access
token using SHA-256 as defined in the OpenID Connect Core specification.
What is not verified here
Cryptographic signature validation requires the provider JWKS and is handled by dedicated JWT tools. Use JWT Verify RSA ES after claim checks pass.
Typical debugging workflow
- Paste the ID token from your token response or browser devtools.
- Set expected issuer, client ID (audience), and nonce from the authorize request.
- Optionally paste the access token to validate
at_hash. - Adjust clock skew if your machine time drifts from the identity provider.
Frequently Asked Questions
Are tokens sent to a server?
No. All parsing and hashing run in your browser. Clear the fields after debugging.
Why does at_hash fail?
at_hash binds the ID token to the access token issued in the same response. A mismatched access token, wrong encoding, or a token from a different login attempt will fail the check.
How is this different from JWT Claims Validator?
JWT Claims Validator focuses on generic registered claims. This tool adds OIDC rules such as mandatory sub, nonce matching, auth_time formatting, and at_hash verification.