Tools

Token decoder

Paste a Trustaige ID token, access token or Security Event Token to see every claim, what it means, and whether the signature checks out.

What your app should check

Decoding shows what a token says; it proves nothing. Before you trust an ID token, your server checks the signature against the issuer's keys, that iss is the issuer you configured, that aud is your client ID, that exp has not passed, and that nonce matches the one you sent. Use your platform's OpenID Connect library rather than writing these checks yourself.