OAuth Token Inspector

About This Tool

Inspect OAuth 2.0 access tokens and OpenID Connect ID tokens. Analyze scopes, issuer, audience, and claims.

What Is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe string defined by RFC 7519. It encodes claims as JSON and attaches a cryptographic signature so receivers can verify the token was issued by a trusted party and was not tampered with.

JWTs consist of three Base64URL-encoded parts separated by dots:

• Header — algorithm (alg) and token type (typ)
• Payload — claims such as sub, iss, aud, exp
• Signature — HMAC or asymmetric signature over header + payload

JWTs are used by OAuth 2.0, OpenID Connect, Auth0, Firebase, AWS Cognito, and most modern API authentication systems.

How JWT Validation Works

OAuth Token Inspector requires more than Base64 decoding. A secure verifier performs these steps on every request:

1. Parse structure — confirm exactly three segments separated by dots
2. Verify signature — HMAC with shared secret, or asymmetric verify with public key from JWKS
3. Validate algorithm — reject unexpected alg values including none
4. Check time claims — exp not past, nbf not future, allow clock skew
5. Validate iss and aud — issuer and audience match your application configuration

Use JWT Validator for HMAC verification or JWKS Validator for RS256/ES256 with JWKS endpoints.

How to Use This Tool

1. Copy a JWT from your application, API response, or browser dev tools
2. Paste into the tool above and click the primary action button
3. Review decoded output, validation result, or error message
4. Use Copy buttons to export results for documentation or support tickets

Example Use Cases

• Debug 401 Unauthorized errors from REST APIs
• Inspect OAuth access tokens and OpenID Connect ID tokens
• Verify token expiration before implementing refresh logic
• Learn JWT structure during onboarding or security reviews

Common JWT Errors

developers encounter these errors frequently:

• Token expired — exp claim is in the past
• Invalid signature — wrong secret, key, or algorithm
• Malformed JWT — not three valid Base64URL segments
• Algorithm not allowed — alg confusion or none attack attempt

Browse the full JWT Error Directory for fixes with step-by-step instructions.

Best Practices for JWT Security

• Never trust decoded payload without signature verification
• Use short-lived access tokens (5–15 minutes) with refresh rotation
• Whitelist allowed algorithms — never accept alg: none
• Store tokens in httpOnly cookies, not localStorage (XSS risk)
• Use RS256/ES256 for public APIs; protect HMAC secrets with 256+ bit random keys
• Validate exp, iss, aud, and sub on every request
• Never log full bearer tokens in application logs

Read our JWT Security Best Practices article and explore the Security Hub.

Explore JWT Guides, Blog, and Learning Path for deeper tutorials.