OAuth Token Inspector

OAuth 2.0 is an authorization framework — a protocol for granting access. JWT (JSON Web Token) is a token format. OAuth tokens can be JWTs, but don't have to be. OIDC (OpenID Connect) extends OAuth 2.0 with identity and mandates JWT for ID tokens.

Yes. This tool runs entirely in your browser — no token data is sent to any server. However, avoid pasting production tokens that grant real access to sensitive resources, as a general best practice.

exp (expiration time) is a Unix timestamp (seconds since 1970-01-01). The token must be rejected after this time. iat (issued at) is when the token was created. nbf (not before) is a timestamp before which the token must not be accepted.

The scope claim lists the permissions granted to the token. Common OIDC scopes include openid (required for OIDC), profile (name, picture), email, and application-specific scopes like read:users or write:orders.

Verifying a JWT signature requires the secret key (HMAC) or public key (RSA/EC). This client-side tool can decode the header and payload but cannot verify the cryptographic signature without the key. For production verification, use your backend or a library like jsonwebtoken (Node.js).

The iss claim identifies who issued the token. For example, https://accounts.google.com for Google OAuth or https://your-auth0-domain.auth0.com for Auth0. Clients should validate that the issuer matches the expected value to prevent token substitution attacks.