decoder.tools

OAuth 2.0 Token Decoder

Decode JWT-format OAuth 2.0 access tokens to check their scope, audience, client and expiry.

Web, API & TokensFree
INPUT
OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

An OAuth token decoder reads an access token that is a JSON Web Token and shows its claims: which scopes it grants, which API it's for, which client asked for it and when it expires. Opaque access tokens are random strings and can't be decoded at all.

Example

Input
eyJhbGciOiJIUzI1NiIsInR5cCI6ImF0K2p3dCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyLTQyIiwiYXVkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20iLCJjbGllbnRfaWQiOiJ3ZWItYXBwIiwic2NvcGUiOiJyZWFkOm9yZGVycyB3cml0ZTpvcmRlcnMiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDAwMDkwMH0.A5X4AFDecdKhYEb55D1QwhPe_5ot0r7w9CQRxY-FgvU
Output
HEADER
{
  "alg": "HS256",
  "typ": "at+jwt"
}

PAYLOAD
{
  "iss": "https://auth.example.com",
  "sub": "user-42",
  "aud": "https://api.example.com",
  "client_id": "web-app",
  "scope": "read:orders write:orders",
  "iat": 1700000000,
  "exp": 1700000900
}

The typ of at+jwt marks a JWT access token as defined by RFC 9068.

JWT versus opaque access tokens

OAuth 2.0 (RFC 6749) doesn't say what an access token looks like. Providers use one of two designs:

  • JWT access tokens carry their claims inside, so an API can validate them locally with the provider's public key. Auth0, Okta, Microsoft Entra ID and Keycloak commonly issue these. You can decode them here.
  • Opaque tokens are random reference strings. Only the authorization server knows what they mean, and an API checks them by calling the provider's introspection endpoint (RFC 7662). There is nothing inside to decode.

A token that starts with eyJ and has two dots is almost certainly a JWT.

Access token claims (RFC 9068)

ClaimMeaning
issAuthorization server that issued the token
subThe user, or the client itself for machine-to-machine tokens
audThe API (resource server) the token is for
client_idThe application that requested the token
scopeSpace-separated permissions, for example read:orders write:orders
exp, iatExpiry and issue time, in Unix seconds
jtiUnique token ID

How to use the OAuth token decoder

  1. Copy the token from the Authorization: Bearer … header or the token response. The Bearer prefix can stay.
  2. Check aud and scope. A 403 from an API usually means a missing scope or the wrong audience.
  3. Check exp. Access tokens are short-lived, often 5 to 60 minutes.

Debugging common errors

  • 401 Unauthorized usually means the token is expired, malformed or signed by an issuer the API doesn't trust. Check exp and iss.
  • 403 Forbidden usually means the token is valid but lacks a scope, or aud names a different API.
  • "invalid audience" means the client requested the token for the wrong resource. Set the audience or resource parameter in the token request.

OAuth access tokens at a glance

SpecificationsRFC 6749 (OAuth 2.0), RFC 9068 (JWT access tokens), RFC 7662 (introspection)
FormatsJWT (decodable) or opaque (not decodable)
Sent asAuthorization: Bearer <token>
Typical lifetime5 to 60 minutes

Frequently asked questions

Can I decode a refresh token?

Usually not. Refresh tokens are almost always opaque, because only the authorization server ever needs to read them.

Why can't this tool decode my access token?

It's probably opaque. If it has no dots or doesn't start with eyJ, it's a reference token, and only the provider's introspection endpoint can tell you what it means.

Is an access token the same as an ID token?

No. An access token is for calling an API. An ID token is an OpenID Connect token that tells the client who logged in. Use the OIDC token decoder for those.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown