OAuth Scope Decoder
Decode OAuth access tokens and JWT scope claims. Paste a JWT (to extract scopes from the payload) or a raw space-separated scope string. Shows permissions with human-readable descriptions. Runs entirely in your browser — tokens are never sent anywhere.
JWT Claims
Decoded Scopes
Frequently Asked Questions
What are OAuth scopes?▼
OAuth scopes define the permissions an application is requesting when a user authorizes it. Scopes like 'read:user', 'repo', 'email' tell the user and authorization server exactly what access the app will have. The principle of least privilege says apps should request only the minimum scopes they need.
What is a JWT and how does it contain scopes?▼
A JWT (JSON Web Token) is a base64-encoded token with three parts: header.payload.signature. The payload often contains a 'scope' or 'scp' claim listing granted permissions. This tool decodes the payload to show you what scopes are embedded in the token.
Are scopes standardized across OAuth providers?▼
No — each provider defines their own scopes. GitHub uses 'repo', 'user', 'admin:org'. Google uses 'https://www.googleapis.com/auth/gmail.readonly'. Auth0 uses custom scopes. OIDC defines standard scopes: 'openid', 'profile', 'email', 'address', 'phone', 'offline_access'.
What is the difference between 'scope' and 'scp' in a JWT?▼
'scope' (string, space-separated) is common in OAuth 2.0 access tokens. 'scp' (array of strings) is used by some providers like Microsoft Azure AD and Auth0. Both represent granted permissions. This tool handles both formats.
Can this tool validate JWT signatures?▼
No — signature validation requires the server's public key or secret. This tool only decodes the payload to show claims and scopes. Never use client-side JWT decoding as a security check. Always validate signatures on your server using a proper JWT library.
Related Products
on GumroadDevToolkit Starter Kit
A ready-to-deploy developer tools website with 12 built-in tools. Astro + Preact + Tailwind. Deploy to Cloudflare Pages for free. Built-in SEO, dark mode, and ad-ready layout.
Buy on Gumroad →TypeScript Quick Reference Toolkit
5 practical reference files for TypeScript developers: cheatsheet, TS vs JS comparison, 20 utility types with real examples, tsconfig best practices template, and 15 common mistakes guide. Print it. Keep it on your desk.
Buy on Gumroad →Developer Productivity Bundle
Stop rebuilding the same setup every project. 51 VSCode snippets, 40 Git aliases, 5 Docker Compose stacks, 5 GitHub Actions workflows, 5 README templates, and a dotfiles kit. Set up a professional dev environment in under an hour.
Buy on Gumroad →You Might Also Need
JWT Decoder
Free JWT decoder. Inspect any JSON Web Token
Open free tool →
JWT Builder
Build and generate JWT tokens online. Create HS256 JWTs with custom header, payload claims, and secret key. Color-coded output. Free tool for testing and learning.
Open free tool →
OAuth2 Flow Visualizer
Visualize OAuth2 authorization flows step by step. Compare Authorization Code, PKCE, Implicit, Client Credentials, and Device Code flows with JS code examples.
Open free tool →
More Free Tools
Related Articles
JWT Authentication Best Practices 2026: Secure Your API Tokens
Complete JWT security guide for 2026. Covers RS256 vs HS256 signing, token storage strategies, expiry and refresh token patterns, revocation, common vulnerabilities, and a production security checklist.
Web Authentication Patterns in 2026: OAuth, Passkeys, and JWT Best Practices
A complete guide to modern web authentication: OAuth 2.0/OIDC, Passkeys/WebAuthn, JWT best practices, session management, and MFA strategies for secure apps.
JWT Token Decoder: How to Debug Authentication Issues
Learn how to use a JWT token decoder to diagnose 401 errors, expired tokens, missing claims, and auth misconfiguration. Practical debugging guide with code examples.
JWT Decoder Online — Inspect JSON Web Tokens Instantly
JWT decoder online — paste any token to see the header, payload, expiry time, and claims decoded in seconds. No library required. Learn how JWT works with code examples.
JWT Decoder Online: Inspect JSON Web Tokens Without a Library
Decode and inspect JWT tokens online for free. Learn JWT structure, how to read claims, verify signatures, and debug authentication issues in your apps.
Enjoying this tool? Get more like it.
Weekly developer tool guides, productivity playbooks & AI tricks. Free. No spam.
Unlock AI-Powered Dev Tools
- ⚡ AI Code Review, Doc Generator & SQL Builder
- ⚡ All premium templates & early access
- ⚡ Member discounts on Gumroad products
$9/mo after trial · Cancel anytime
Want the full toolkit?
Get DevPlaybook Pro
Every template, guide, boilerplate, and automation script in one bundle. 13 premium products — grab them all at once and save big.
MIT licensed · Instant download · No subscription
See what's included → Browse all deals →