OAuth2 & OpenID Connect Debugger

If nothing is displayed, then the requested token retrieved from the endpoint is not a JWT or not a valid JWT.

Although, many leading IdPs use JWT as the format for OAuth2 access tokens and refresh tokens. The spec does not require this.

Some IdPs intentionally use opaque tokens that have no deeper meaning than to be a randomly generated identifier that points back to session information stored on the IdP. If this is the case, return to the Token Endpoint screen and navigate to the UserInfo Endpoint screen or Token Introspection Screen.

Decoded Token

Return to debugger
JWT Header:The decoded JWT Header. Strip newlines from clipboard value
JWT Payload:The decoded JWT Proposer. Strip newlines from clipboard value
Verification Type:The JWT Verification Type.
JWT Verification Key/URL:The JWT Verification Key/URL.

Verification Output:Verification Output.

Return to debugger
JWT Header:JWT Header Key-Value Pairs.
JWT Payload:JWT Proposer Key-Value Pairs.
Verification Type:The JWT Verification Type.
JWT Verification Key/URL:The JWT Verification Key/URL.

Verification Output:Verification Output.

Claims Validation

JWT Purpose:Select the token type to apply the appropriate validation rules.
Expected Issuer (iss):Leave blank to skip issuer validation.
Expected Audience (aud):A single audience value that must appear in the aud claim. Leave blank to skip audience validation.
Client ID:Used to validate azp (OIDC) and client_id (RFC 9068).
Required Scope(s):Space-separated list of scopes that must all be present in the scope claim. Leave blank to skip.
Clock Skew Tolerance (seconds):Seconds of tolerance applied to exp, nbf, and iat time checks.

Validation Output:All validation errors are listed here. Empty means all checks passed.

^* Claim descriptions are sourced from the IANA JSON Web Token Claims Registry unless otherwise noted.