OAuth Token Decoder - Inspect Access & Refresh Tokens

Decode and inspect OAuth 2.0 tokens. Analyze JWT access tokens, check expiration, view claims and scopes. Browser-based, private, no server.

OAuth Token

Token Status

Paste a token to analyze

Decoded payload will appear here

Decoded header will appear here

Header: -

Payload: -

Signature: -

OIDC Token Decoder - Decode OpenID Conne…

View all Oauth decoders →

Frequently Asked Questions

JWT-format access tokens (most common), ID tokens from OpenID Connect, and any Base64-encoded token. Opaque tokens (random strings) cannot be decoded client-side.

Yes. All decoding happens locally in your browser using JavaScript. Your tokens are never sent to any server. However, avoid sharing decoded token contents.

An access token authorizes API requests on behalf of a user. It contains claims like user ID, scopes (permissions), issuer, and expiration time.

A refresh token is used to obtain new access tokens when they expire. Refresh tokens are usually opaque (not JWT) and can't be decoded here.

Common claims: iss (issuer), sub (subject/user), aud (audience), exp (expiration), iat (issued at), scope/scp (permissions), and custom claims.

The decoder reads the 'exp' claim and compares it to current time. Expired tokens are clearly indicated with the expiration timestamp.

JWT tokens have three parts: header, payload, signature. The signature verifies the token wasn't tampered with. This tool shows but doesn't verify signatures.

No. Signature validation requires the issuer's public key or secret. This tool decodes and displays token contents but cannot cryptographically verify them.

OAuth 2.0 is an authorization framework. JWT (JSON Web Token) is a token format often used by OAuth. Not all OAuth tokens are JWTs.

The token may be opaque (not JWT), corrupted, truncated, or in a non-standard format. JWT tokens have three Base64 parts separated by dots.

Related Tools