Access Token Decoder
Paste your OAuth access token to decode it. If it is a JWT, you will instantly see its scopes, audience, expiry, and all claims — entirely in your browser.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What is an OAuth access token?
An OAuth 2.0 access token is a credential that authorizes requests to an API. It is included in the Authorization header as a Bearer token: Authorization: Bearer <token>. Access tokens come in two forms: opaque tokens (random strings that only the authorization server can interpret) and JWT access tokens (self-contained tokens that APIs can verify locally by checking the signature).
When an access token is a JWT, the API can validate it without making a network call to the authorization server — it just verifies the signature using the published public key. The scope (or scp) claim lists the permissions granted. The aud claim identifies which API the token is intended for, and APIs should reject tokens with the wrong audience.
Paste your access token above. If it has three Base64Url-encoded sections separated by dots, it is a JWT and will decode instantly. If it is an opaque token (a random string or base64 blob), it cannot be decoded locally — you would need to call the authorization server's introspection endpoint (RFC 7662) to read its metadata.
Header
Specifies the token type (typ) and the signing algorithm (alg), such as HS256 or RS256. Base64Url encoded.
Payload
Contains the claims — statements about the subject such as sub, name, roles, and timestamps like iat and exp.
Signature
Created by signing the encoded header and payload with a secret or private key. Guarantees integrity.
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.