JWT Decoder
Security Local only
OAuth 2.0, OIDC & PKCE Debugger
User-triggered networkBuild a safe PKCE flow, parse callbacks, inspect claims, and verify JWT signatures with JWKS.
Discovery and PKCE
Nothing is fetched automatically. Review the derived URL before making a CORS-bound request.
https://accounts.google.com/.well-known/openid-configuration
0 / 43–128
S256
••••••••••••••••••••
••••••••••••••••••••
How to use it
- 01
Discover and prepare PKCE
Load metadata on demand or paste it locally, then generate a verifier, S256 challenge, state, and nonce.
- 02
Build and complete authorization
Create an Authorization Code request, open it deliberately, parse the redirect, and compare state before token exchange.
- 03
Inspect and verify tokens
Decode a JWT, review time and identity claims separately, then fetch or import JWKS for cryptographic verification.
Frequently asked questions
Does this tool store OAuth secrets or tokens?
No. Verifiers, codes, state, nonce, tokens, and JWKS remain in memory and are cleared when the workspace is reset or closed.
Why does discovery or token exchange fail in the browser?
The authorization server must allow the cross-origin request. Generated cURL and Fetch examples remain available when browser CORS blocks direct exchange.
Does decoding a JWT prove it is genuine?
No. Decoding only reveals claims. Authenticity requires a successful signature check with a trusted key plus issuer, audience, time, and nonce checks.
Can I enter a client secret?
No. This workspace is intentionally limited to public-client Authorization Code + PKCE and does not implement implicit, password, or confidential-client secret flows.
Related tools
Keep working with other focused browser utilities.