What Is an OAuth2 Token Debugger?
This OAuth2 and OpenID Connect workspace inspects JWT-shaped access or ID tokens, extracts authorization-request parameters, and implements RFC 7636 PKCE generation and verification. It creates a cryptographically random 43–128 character code_verifier, derives the unpadded base64url S256 code_challenge with Web Crypto, and can compare that verifier with a challenge copied from an authorization URL. Token decoding is structural only: it does not verify a signature, issuer, audience, or server trust.
How to Use the OAuth2 Token Debugger
- 1Choose Decode Token for JWT structure, Parse Auth URL for request parameters, or PKCE Generator & Verifier for RFC 7636 values.
- 2For token decoding, paste your access_token or id_token. The tool decodes the JWT header and payload and displays them as formatted JSON.
- 3For URL parsing, paste a full OAuth2 authorization URL (e.g., from your browser address bar during a login flow).
- 4The URL parser extracts and labels all query parameters, highlighting known OAuth2 parameters like client_id, scope, and PKCE fields.
- 5For PKCE, generate a verifier with S256, copy the challenge into the authorization request, and keep the verifier only for the later token exchange.
- 6Paste an expected challenge or import one from the parsed URL to confirm that it was derived from the same verifier.
Common Use Cases
Debugging Login Flows
When an OAuth2 login flow fails, paste the authorization URL to verify that client_id, redirect_uri, and scope parameters are set correctly.
Inspecting ID Tokens
After an OIDC authentication, decode the id_token to verify the user's identity claims such as email, name, and audience.
PKCE Verification
Generate an unbiased random verifier, derive its S256 challenge, and compare it with the exact code_challenge in an authorization request.
Token Scope Validation
Decode access tokens to verify that the granted scopes match what your application requested and needs.
Frequently asked questions
What types of tokens can this tool decode?
This tool can decode any JWT (JSON Web Token) format token, which includes most OAuth2 access tokens and all OIDC ID tokens. Opaque tokens (random strings without JWT structure) cannot be decoded as they contain no readable claims.
What is PKCE and why do I see code_challenge in the URL?
PKCE (Proof Key for Code Exchange) is a security extension for OAuth2 that prevents authorization code interception attacks. The code_challenge parameter in the authorization URL is a hashed version of a secret that the client will later prove it knows during the token exchange.
Why is the state parameter important in OAuth2?
The state parameter is a CSRF protection mechanism. Your application generates a random value, includes it in the authorization request, and verifies it matches when the user is redirected back. This prevents attackers from forging authorization responses.
Should I use S256 or plain for PKCE?
Use S256 whenever the authorization server supports it. S256 sends a SHA-256-derived challenge, while plain sends the verifier itself in the authorization request and loses PKCE's protection against request observers. Modern OAuth clients and servers should use S256.
Are generated verifiers sent anywhere?
No. Secure random generation, SHA-256, base64url conversion, token decoding, and URL parsing run in the browser. The verifier is a temporary secret: do not put it in logs, source control, analytics, or the authorization URL.