Decode an AWS Cognito JWT
Decode AWS Cognito ID and access tokens. Inspect token_use, cognito:groups, client_id and username claims. Free local JWT decoder.
Part of the free JWT Decoder. Runs in your browser — nothing is uploaded.
Decode an AWS Cognito JWT
Cognito issues three tokens: ID, access and refresh. The ID and access tokens are JWTs with an issuer like cognito-idp.<region>.amazonaws.com/<pool-id>. Decode them to check groups, client IDs and token_use.
Worked example: Illustrative Cognito-style access token
JWT
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleS0yMDI2LTAxIn0.eyJzdWIiOiJhMWIyYzNkNC0wMDAwLTExMTEtMjIyMi0zMzMzNDQ0NDU1NTUiLCJjb2duaXRvOmdyb3VwcyI6WyJhZG1pbnMiXSwiaXNzIjoiaHR0cHM6Ly9jb2duaXRvLWlkcC51cy1lYXN0LTEuYW1hem9uYXdzLmNvbS91cy1lYXN0LTFfRVhBTVBMRSIsImNsaWVudF9pZCI6IjFleGFtcGxlMjM0NTY3ODkiLCJ0b2tlbl91c2UiOiJhY2Nlc3MiLCJzY29wZSI6ImF3cy5jb2duaXRvLnNpZ25pbi51c2VyLmFkbWluIiwiYXV0aF90aW1lIjoxNzY3MjI1NjAwLCJleHAiOjE3NjcyMjkyMDAsImlhdCI6MTc2NzIyNTYwMCwidXNlcm5hbWUiOiJhZGEifQ.c2lnbmF0dXJl
Decoded token
// HEADER
{
"alg": "RS256",
"typ": "JWT",
"kid": "key-2026-01"
}
// PAYLOAD
{
"sub": "a1b2c3d4-0000-1111-2222-333344445555",
"cognito:groups": [
"admins"
],
"iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE",
"client_id": "1example23456789",
"token_use": "access",
"scope": "aws.cognito.signin.user.admin",
"auth_time": 1767225600,
"exp": 1767229200,
"iat": 1767225600,
"username": "ada"
}
// CLAIM TIMES (UTC)
iat: 2026-01-01 00:00:00 UTC
exp: 2026-01-01 01:00:00 UTCPractical tip
Check token_use. Use the access token to call APIs and the ID token to read user attributes. Mixing them up is a common authorization bug.
How to use this JWT Decoder
- 1Use the live tool above — it runs entirely in your browser and never uploads your data.
- 2Paste the sample from the worked example, or use your own input.
- 3Copy the result, then adapt the same steps in your editor, script, or pipeline.
Decode an AWS Cognito JWT FAQs
What is token_use in a Cognito JWT?
It is either "id" or "access". It tells your backend which kind of token it received so it can apply the right validation rules.
Where do Cognito groups appear?
In the cognito:groups claim, as an array of group names, in both ID and access tokens when the user belongs to groups.
More JWT Decoder pages
- Decode a JWT Token OnlineDecode a JWT token online to read its header and payload claims. Paste the token and see readable JSON instantly. Runs in your browser, nothing is uploaded.
- JWT Expiration CheckerCheck when a JWT expires. Paste the token to read the exp claim as a human-readable UTC date and see if your access token is still valid.
- Decode a JWT Without the SecretYou can decode a JWT without the secret because the header and payload are only Base64URL encoded. Paste a token to read it. Verification needs the key.
- JWT Payload ViewerView the JWT payload and its claims such as iss, aud and sub. Paste a token to inspect who issued it, who it is for and what scopes it carries.
- Decode an Auth0 JWTDecode Auth0 ID tokens and access tokens to inspect claims like iss, aud, scope and custom namespaced claims. Free, local and private.
- Decode a Firebase ID TokenDecode a Firebase Authentication ID token to inspect uid, email, auth_time and sign-in provider claims. Free browser-based Firebase JWT decoder.
- JWT Header and Algorithm CheckerCheck a JWT header for the alg, typ and kid fields. Find out whether a token is signed with HS256 or RS256 and which key ID to verify with.
- JWT Claims Explained With a Live DecoderLearn what every registered JWT claim means: iss, sub, aud, exp, nbf, iat and jti. Paste a token to see each claim decoded.
- JWT nbf (Not Before) Claim CheckerCheck the JWT nbf claim. See the "not before" time as a readable UTC date and find out why a fresh token is rejected as not yet valid.