Why can't my access token be decoded?

It is an opaque token — a random identifier with no structure, meaningful only to the authorization server. Use that server's introspection endpoint to inspect it; no local tool can decode it.

Can I decode a refresh token?

Only if it is a JWT, which is less common — refresh tokens are usually opaque by design, since they are long-lived and meant to be meaningless outside the server.

What is the difference between scope and audience?

Scope says what the token is allowed to do; audience says which resource server should accept it. A token with the right scopes but the wrong audience is still rejected.

Is pasting a live access token here safe?

Decoding is entirely local and nothing leaves your browser. Even so, a live token is a credential — prefer a test token, and revoke anything you suspect has leaked.

OAuth 2.0 Token Decoder

Inspect OAuth 2.0 access and refresh tokens, including JWT-shaped bearer tokens.

live · client-sideWeb, API & Tokensfree · no sign-up

RAW INPUT

DECODED

Output appears here as you type — decoded on your device.

Input is processed on your device. Nothing you paste is sent anywhere.

What is the OAuth 2.0 Token Decoder?

An OAuth token decoder inspects an OAuth 2.0 access or refresh token and, when the token is a structured JWT rather than an opaque random string, decodes its claims to reveal scopes, audience, issuer and expiry.

OAuth 2.0 (RFC 6749) never mandated a token format, so there are two kinds in the wild. Opaque tokens are random strings meaningful only to the issuing server — the only way to inspect one is the introspection endpoint (RFC 7662). Structured tokens are JWTs, which carry their claims inside the token itself, and those you can decode locally.

For JWT-shaped tokens the interesting claims are scope or scp (what the token permits), aud (which API will accept it), azp or client_id (which application asked for it), exp (when it dies) and sub (whose data it reaches). Nearly every 401 or 403 in an OAuth integration traces back to one of those five values being different from what you assumed.

This decoder detects whether your token has the three-part JWT shape and decodes it if so, reporting plainly when a token is opaque instead of inventing a result.

OAuth 2.0 Token Decoder at a glance

Specification: RFC 6749 (OAuth 2.0) · RFC 9068 (JWT access tokens)
Token types: Opaque (server-side lookup) or JWT (self-contained)
Scope claim: scope or scp — space-delimited permissions
Introspection: RFC 7662 — required for opaque tokens

How to use the OAuth 2.0 Token Decoder

1Paste the access or refresh token, with or without the Bearer prefix.
2If it is a JWT, the header and claims are decoded and timestamps rendered as dates.
3Compare scope, aud and exp against what your API expects.

When you would reach for it

Working out why an API call returns 403 when the login clearly succeeded.
Verifying that a consent screen actually granted the scopes you requested.
Checking token lifetimes while tuning refresh logic.

OAuth 2.0 Token Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools