OAuth Token Inspector
Paste an access token to find out what it is. JWTs get decoded into a readable claims table with human expiry dates; opaque tokens get a length, entropy and character-set analysis. Everything runs locally — nothing is sent anywhere.
Header
| Claim | Value |
|---|
Payload claims
| Claim | Value | Details |
|---|
Opaque token analysis
This token cannot be decoded — it is an opaque reference. Here is what can be measured from the string itself:
| Property | Value |
|---|
- Paste an access token (or an authorization code / refresh token value) into the box.
- Click Inspect Token. JWT tokens are decoded into header and payload claims tables; everything else gets an opaque-token analysis.
- Check the expiry badge: green means the token is currently valid, red means expired, blue means not yet valid (nbf in the future).
- Use Copy Claims as Text to copy the full decoded list to your clipboard.
- Load Sample fills in a demo JWT (valid for one hour from now) if you want to try the tool without a real token.
What is a JWT?
A JSON Web Token has three dot-separated parts: header, payload and signature. The payload holds claims such as sub, exp and iat. Decoding only reads the text — it does not verify the signature.
What is an opaque token?
An opaque token is a random reference string. Only the authorization server that issued it knows what it means, so the tool can only measure its length, character set and estimated entropy.
Why are exp, iat and nbf shown as dates?
These claims are Unix timestamps (seconds since 1970). The tool converts them to your local date and time so you can read them at a glance.
How is entropy estimated?
Entropy ≈ length × log₂(alphabet size), where the alphabet size comes from the character classes present (lowercase, uppercase, digits, symbols). It is a rough estimate of guessing difficulty, not a security audit.