Decode an OAuth access or refresh token

Inspect an OAuth bearer token when its format is readable.

freeworks offlinenothing uploaded
ToolOAuth Token Decoder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

The bearer token is separated from its transport wrapper and decoded according to its actual format; opaque tokens remain uninterpretable while JWTs expose header and claim JSON without validating trust. Decoding never calls the authorization server or proves the token is active.

  • OAuth permits opaque references as well as self-contained JWTs.

Worked example

Inspect OAuth 2.0 JWT access token
Decode an RS256-signed OAuth access token to see scopes, client ID, and expiry
Input
											eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEyMyIsInNjb3BlIjoicmVhZCB3cml0ZSIsImNsaWVudF9pZCI6Im15LWFwcCIsImV4cCI6MTcwMDAwMDAwMH0.fake-signature
Output
												=== OAuth Token Analysis ===

Type: JWT (JSON Web Token)

Header:
{
  "alg": "RS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "user-123",
  "scope": "read write",
  "client_id": "my-app",
  "exp": 1700000000
}

Scope: read write
Client ID: my-app
Expires: 2023-11-14T22:13:20.000Z

When to use this

API support, gateway diagnostics, and client token troubleshooting inspect bearer tokens.

Edge cases

  • An opaque token can be valid but contain no readable claims.
  • Base64url segments may omit padding.
  • Readable claims can be forged or stale without signature and issuer checks.

References