Free OAuth Token Decoder
Quick Tips
- • This tool runs entirely in your browser - your data stays private.
- • Press Ctrl+V (Cmd+V on Mac) to quickly paste text.
- • Use the Copy button to save your result to clipboard.
- • Bookmark this page for quick access!
Decode and inspect OAuth access tokens and ID tokens.
Your Recent Tools
Examples
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyMTIzIiwiYXVkIjoiYXBpLmV4YW1wbGUuY29tIiwic2NvcGUiOiJyZWFkIHdyaXRlIn0.signature
Claims: iss, sub, aud, scope Scopes: read, write
Why Use This Tool?
What problems does this solve?
OAuth and OIDC debugging requires understanding token contents. This tool quickly reveals claims, scopes, and expiration to help diagnose authorization issues.
Common use cases:
- Debugging API authorization failures
- Verifying OAuth scopes granted to applications
- Inspecting ID token claims for user information
- Understanding token structure from different providers
- Learning about OAuth 2.0 and OpenID Connect
Who benefits from this tool?
Developers integrating with OAuth providers. Security engineers auditing authorization implementations. Anyone debugging OAuth-based authentication flows.
Privacy first: All decoding happens locally in your browser. Your tokens never leave your device.
Frequently Asked Questions
Not all OAuth tokens are JWTs. Some providers use opaque tokens (random strings) that can only be validated via the introspection endpoint. If it does not decode, it is likely opaque.
Access tokens authorize API access and contain scopes/permissions. ID tokens from OpenID Connect contain user identity information like name and email. Both can be JWTs.
Look for the "scope" claim (space-separated list) or "scp" claim (array) depending on the provider. These indicate what permissions the token grants.
The aud (audience) claim identifies the intended recipient of the token, usually the API or resource server. Tokens should be rejected if your service is not in the audience.
No, always verify token signatures server-side before trusting claims. This tool is for inspection and debugging only. Unverified claims could be from forged tokens.
Yes, decoding happens entirely in your browser. However, access tokens are sensitive credentials - never paste them into server-based tools or share them publicly.
Related Tools
JWT Decoder
<p>The JWT Decoder parses JSON Web Tokens to reveal their he...
JWT Encoder
<p>The JWT Encoder creates JSON Web Tokens from your specifi...
API Key Generator
<p>The API Key Generator creates cryptographically secure ra...
QR Code Decoder
<p>The QR Code Decoder extracts data from QR code images. Up...
Base32 Encoder/Decoder
<p>The Base32 Encoder/Decoder converts data to and from Base...
Base64 Encoder/Decoder
<p>The Base64 Encoder/Decoder is a comprehensive tool for co...