OAuth Token Decoder

Runs in browser Security

Decode JWT-formatted OAuth 2.0 access tokens and OIDC ID tokens, explaining scopes, azp, nonce, auth_time and provider-specific claims from Azure AD, Auth0, Keycloak, Google and Okta.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use OAuth Token Decoder

  1. Copy the access_token or id_token from your OAuth response (or the Authorization header).
  2. Paste it and read the token summary: type, provider, issuer, audience and validity.
  3. Check the scopes table to confirm the permissions actually granted.
  4. Use the claims table to understand provider-specific fields.

OAuth Token Decoder features

  • Identifies ID tokens, access tokens, logout tokens and DPoP proofs
  • Detects Azure AD (Entra ID), Auth0, Keycloak, Google, Okta, Cognito, Firebase and Apple tokens
  • Explains scope/scp values and provider-specific claims (tid, oid, azp, realm_access, gty, hd…)
  • Shows issuer, audience, client, subject, authentication time and methods
  • Validity summary with lifetime; warns when an ID token is used as a bearer token
  • Full claims table plus raw header and payload JSON

OAuth Token Decoder example

Azure AD v2.0 access token

Input:

{"aud":"api://orders","iss":"https://login.microsoftonline.com/<tenant>/v2.0","scp":"Orders.Read Orders.Write openid profile","tid":"<tenant>","oid":"<object-id>","azp":"<client-id>","ver":"2.0", …}

Output:

Token type: Access token · Provider: Azure AD (Microsoft Entra ID)
Audience: api://orders · Client: <client-id> · Tenant: <tenant>
Scopes: Orders.Read, Orders.Write, openid (requests an ID token), profile (basic profile claims)

Frequently asked questions about OAuth Token Decoder

What is the difference between an ID token and an access token?

An ID token (OpenID Connect) tells the client application who the user is and is meant for the client only. An access token authorises calls to an API (the resource server). The tool guesses the type from typ, nonce, scope and provider-specific claims.

My access token is not a JWT — can it be decoded?

No. Many providers (GitHub, some Google and Auth0 configurations) issue opaque tokens that are just random strings. Only the issuer can explain them through a token-introspection endpoint.

How is the provider detected?

From the issuer URL and characteristic claims: tid/oid for Azure AD (Entra ID), realm_access for Keycloak, gty/permissions for Auth0, hd for Google, uid/cid for Okta, token_use for Cognito, and so on.

What do scope and scp mean?

Both list the permissions granted to the token. scope is the standard space-separated form (RFC 6749/8693); scp is used by Azure AD and Okta. Each scope is explained where the meaning is known.

Technical notes

OAuth 2.0 does not mandate a token format, but most providers issue JWT access tokens following RFC 9068 (typ "at+jwt", client_id, scope) and OIDC ID tokens (nonce, at_hash, auth_time, amr). Provider detection uses the issuer host and characteristic claims; when nothing matches the token is still fully decoded.