Inspect OAuth and OpenID Connect Tokens
Decode access tokens, ID tokens, and refresh tokens from Google, Auth0, Okta, Microsoft, and other OAuth providers.
🔒 The token is decoded entirely in your browser. Nothing is sent to any server.
OAuth / OIDC tips
ID tokens contain user identity claims (`sub`, `email`, `name`). Access tokens contain authorization claims (`scope`, `roles`). They serve different purposes.
For Google OAuth tokens, the `email_verified` claim is essential — never trust the `email` claim without verifying this is `true`.
Auth0 and Okta tokens use custom claims with namespace URLs (e.g., `https://yourapp.com/roles`). These appear in the payload but aren't standard claims.
Microsoft Entra (Azure AD) tokens have specific claims like `tid` (tenant ID), `oid` (object ID), and `appid` — see them clearly in the decoded payload.
Conas a Oibríonn sé
Cén fáth ár gceann a úsáid?
Also check out…
Debug Authentication Issues with JWT Decoder
Inspect JWTs from your app to debug login failures
Inspect API Tokens While Testing Endpoints
Decode JWTs returned by your API to verify the rig
Security Audit JWT Tokens
Review JWTs as part of a security audit — check fo
Learn How JWT Tokens Work
Decode example JWTs to understand the structure: h