OAuth 2.0 Token Decoder
Paste an OAuth 2.0 JWT access token to decode its claims — including scopes, client ID, expiry, and audience. Verify the signature client-side using the authorization server's public key.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding OAuth 2.0 JWT Tokens
OAuth 2.0 defines how applications can obtain access tokens to call APIs on behalf of users or as themselves. Modern OAuth 2.0 servers typically issue access tokens as JWTs (defined in RFC 9068) so that resource servers can verify tokens locally without calling back to the authorization server. The token contains the granted scopes, the subject (user or client), the audience (the API), and expiry information.
OAuth 2.0 supports several grant types: Authorization Code (user authenticates in a browser, most secure), Client Credentials (machine-to-machine, no user), Device Code (for devices without a browser), and Refresh Token (exchanging a refresh token for a new access token). The token format and claims are similar across grant types, but the subject may be a user ID (authorization code flow) or a client ID (client credentials flow).
Paste your OAuth JWT access token above to inspect its claims. Key claims to check: scope (granted permissions), aud (intended API), iss (authorization server), exp (expiry time), and sub (user or client identifier). Use the Signature tab to verify the token's authenticity using the authorization server's public key.
Common OAuth 2.0 JWT claims
issIssuer — the authorization server that issued this token.
e.g. https://auth.example.com
subSubject — the user ID (auth code flow) or client ID (client credentials).
e.g. user123
audAudience — the API(s) this token is authorized to call.
e.g. https://api.example.com
scopeSpace-separated list of granted OAuth scopes.
e.g. read:orders write:orders
client_idThe OAuth client application that obtained this token.
e.g. app_abc123
jtiJWT ID — a unique identifier to prevent token replay.
e.g. a1b2c3-...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.