OAuth2 Debugger
Decode and debug any JWT token - access tokens, ID tokens, and refresh tokens. Our OAuth2 debugger instantly decodes the header and payload, identifies the token type, checks expiry, and provides detailed explanations for every claim including security warnings. All processing happens locally in your browser - no data is sent to any server. Completely free, no signup required.
Paste any JWT token to decode and inspect its contents. The debugger identifies the token type (access token, ID token, or refresh token), decodes the header and payload, checks expiry, and provides detailed explanations for every claim - all processed locally in your browser.
Paste the full JWT token (header.payload.signature). All processing happens locally in your browser.
Why Use Our OAuth2 Debugger?
Instant JWT Token Decoding
Paste any JWT token and instantly decode its header and payload. The tool automatically parses the base64-encoded JSON segments, identifies the token type (access token, ID token, or refresh token), and displays all claims in a clean, organized format.
Expiry Validation & Security Checks
Automatically checks if a token has expired or is still valid, with clear visual indicators. Detects security issues like missing algorithms, non-URL issuers, and critical security claims. Every claim includes an importance badge so you know what to focus on.
Comprehensive Claim Decoding
Decodes and explains 30+ standard JWT claims including iss, sub, aud, exp, scope, client_id, and roles. Each claim has a plain-English description of what it means and why it matters. Custom claims are also displayed with their raw values.
100% Client-Side Processing
All token decoding happens locally in your browser using built-in base64 decoding. Your tokens are never sent to any server, stored, or logged. No signup, no API keys, no data leaves your device. Includes example tokens for testing.
Common Use Cases for OAuth2 Debugger
Debugging OAuth2 Authentication Flows
When an OAuth2 or OIDC authentication flow fails, decode your tokens to inspect the claims. Check if the issuer matches, if scopes are correctly granted, if the audience is valid, and if the token has the correct expiry. Quickly pinpoint misconfigurations.
Security Token Analysis
Security researchers and penetration testers can decode tokens to analyse their contents without sending them to an external service. Check for sensitive data exposure in claims, verify algorithm usage, and inspect token structure for security best practices.
API Development & Integration
When integrating with an OAuth2-protected API, decode the access tokens to verify they contain the expected claims, scopes, and audience. Test different token types and understand what information is available for authorisation decisions.
Learning JWT & OAuth2 Standards
Use the debugger to learn how JWTs are structured. See how the header defines the signing algorithm, how the payload carries claims, and how the signature provides integrity. The detailed claim descriptions make it an excellent learning tool.
Multi-Provider Token Verification
Decode tokens from different OAuth2 providers (Google, Auth0, Azure AD, Okta, Keycloak) and compare their claim structures. Each provider uses slightly different claims and formats - the debugger helps you understand the differences.
Troubleshooting Token Expiry Issues
When users report being logged out unexpectedly, decode their tokens to check the expiration time. The debugger shows exactly when the token was issued and when it expires, helping you diagnose if short token lifetimes or clock skew issues are causing problems.
Understanding OAuth2 & JWT Tokens
What Are JWT Tokens?
JSON Web Tokens (JWTs) are a compact, URL-safe means of representing claims between two parties. They consist of three parts separated by dots: a header that describes the signing algorithm and token type, a payload that contains the claims (data), and an optional signaturethat verifies the token hasn't been tampered with. JWTs are commonly used in OAuth 2.0 and OpenID Connect (OIDC) for access tokens and ID tokens.
How Our OAuth2 Debugger Works
- Paste Your Token - Paste any JWT token into the input area. The tool automatically detects the three dot-separated segments (header.payload.signature).
- Automatic Decoding - The tool decodes each base64url-encoded segment using your browser's built-in
atob()function, parses the JSON, and extracts all claims. - Analysis & Display - Token type is identified, expiry is checked against the current time, and every claim is displayed with its importance level, description, and any security warnings.
Token Types You Can Decode
- Access Tokens - Used to access protected API resources. Contains claims like scope, client_id, and the authorized party (azp). Usually short-lived.
- ID Tokens - Used in OpenID Connect to authenticate users. Contains identity claims like name, email, picture, and nonce for replay protection.
- Refresh Tokens - Long-lived tokens used to obtain new access tokens without user interaction. Usually contain fewer claims.
- Opaque Tokens - Tokens that cannot be decoded because they contain no parseable JSON data. These must be validated via an introspection endpoint.
Privacy, Security & Availability
Your privacy is our priority. All token decoding is performed entirely in your browser using the built-in atob() function - your tokens are never sent to any server, and no data is logged or stored. The OAuth2 debugger is completely free to use with no signup, no API keys, and no usage limits. However, please be aware that pasting tokens containing sensitive information into any online tool carries inherent risk - use caution and consider the sensitivity of the data in your tokens.
Related Tools
DNS Propagation Checker
Check if DNS changes have propagated by querying multiple global nameservers (Cloudflare, Google, Quad9). Shows propagation status across regions with live results and colour-coded status indicators - free online DNS propagation checker.
Domain Age Checker
Check the age of any domain in years, months, weeks, and days. Enter a domain name to get its creation date, registration timeline, registrar info, and SEO authority estimate based on domain age - all fetched from the official RDAP registry in real time. Free online domain age checker.
Bulk WHOIS Lookup
Check domain registration information for up to 20 domains at once using the RDAP protocol. View registrar, creation date, expiry date, nameservers, and domain status codes in a sortable table - free online bulk WHOIS lookup.
Domain Expiry Checker
Check when any domain expires - enter a domain name to see its expiration date, days remaining, registrar lock status, auto-renew status, and complete WHOIS details. Colour-coded health indicators show whether renewal is urgent. Free online domain expiry checker.
Frequently Asked Questions About OAuth2 Debugger
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three base64-encoded parts separated by dots: a header (algorithm and token type), a payload (the actual data/claims), and a signature (to verify integrity). JWTs are widely used in OAuth 2.0 and OpenID Connect for access tokens and ID tokens.
All token decoding happens entirely in your browser using the built-in atob() function. Your token is never sent to any server, stored, or logged. However, you should always be cautious about pasting tokens containing sensitive information into any online tool. For production tokens with sensitive data, consider using a local tool.
No. This tool decodes the header and payload of a JWT so you can inspect their contents, but it does not verify the cryptographic signature. Signature verification requires the issuer's public key (for asymmetric algorithms like RS256) or shared secret (for symmetric algorithms like HS256), which this tool does not have access to.
An access token is used to access protected API resources and typically contains scopes, client_id, and the authorized party. An ID token is used in OpenID Connect to authenticate the user and contains identity information like name, email, and picture. ID tokens are meant to be inspected by the client application, while access tokens are meant for the resource server.
The exp (expiration time) claim indicates when the token expires. If the current time is past the exp timestamp, the token is considered expired and will be rejected by the authorization server or resource server. You'll need to obtain a new token, typically using a refresh token or by re-authenticating the user.
Common algorithms include RS256 (RSA with SHA-256, asymmetric - most common), ES256 (ECDSA with P-256, asymmetric), and HS256 (HMAC with SHA-256, symmetric). The "alg" field in the header tells you which algorithm was used. Asymmetric algorithms use a private key to sign and a public key to verify, while symmetric algorithms use a shared secret for both.
An opaque token is a token whose format is not parseable - it contains no base64-encoded JSON data. Unlike JWTs, opaque tokens cannot be decoded locally. They must be validated by sending them to the authorization server's introspection endpoint. Many providers use opaque tokens for access tokens and JWTs for ID tokens.
Yes, as long as the token is a JWT (identifiable by having three dot-separated segments). Common providers that use JWT access tokens include Auth0, Okta, Azure AD, Amazon Cognito, and Keycloak. Google uses JWTs for ID tokens but may use opaque tokens for access tokens. The decoded JSON will show provider-specific claims.
Standard registered claims include iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (JWT ID). OAuth2/OIDC-specific claims include scope, client_id, azp (authorized party), nonce, at_hash, and identity claims like name, email, preferred_username, roles, and groups.
Yes! The OAuth2 Debugger is completely free with no signup, no account, and no API keys required. All token decoding happens locally in your browser - no data is sent to any server, and no usage limits apply.