OAuth 2.0 Token Debugger

An OAuth 2.0 access token is a credential issued by an authorization server that grants a client access to specific resources on behalf of a user. Modern OAuth implementations typically use JWT (JSON Web Token) as the token format — a compact, self-contained structure with header, payload, and signature. The payload contains claims like user ID (sub), expiry (exp), issuer (iss), and granted scopes.

Yes — this debugger runs entirely in your browser using JavaScript. Your token is never sent to any server or third party. However, as a best practice, avoid pasting real production tokens that grant access to sensitive systems. Rotate tokens after debugging sessions if in doubt.

Scopes are space-separated strings in the scope claim that define what the token is authorized to do. Standard OIDC scopes include openid (establishes identity layer), profile (name, picture), and email. Application-specific scopes follow formats like read:users or write:orders. The token holder can only perform actions covered by the granted scopes.

An access token is used to authorize API calls — it proves the bearer is allowed to perform certain actions. An ID token (OIDC) is used to authenticate — it proves who the user is and contains identity claims (name, email, picture). ID tokens contain the at_hash claim and are typically shorter-lived. Access tokens are sent with API requests; ID tokens are consumed by the client to establish a user session.

JWT signature verification requires either your HMAC secret key (for HS256) or the issuer's public key (for RS256/ES256). These keys should never be exposed in a browser. This tool decodes the header and payload (which are just base64url-encoded) but cannot cryptographically verify the signature without the key. For production verification, use your backend with a library like jsonwebtoken (Node.js) or python-jose (Python).

exp (expiration time) is a Unix timestamp (seconds since January 1, 1970). Any token with an exp value in the past is considered expired and should be rejected by resource servers. Access tokens are typically short-lived (minutes to hours) to limit damage if stolen. Always check token expiry before using it in API calls to avoid 401 Unauthorized errors.