A browser-based toolbox for debugging OIDC and OAuth 2.0: decode tokens, test introspection endpoints, inspect discovery documents and signing keys — against any identity provider.
Everything you reach for when a token “doesn’t work” — in one place, without curl, jwt.io tabs and echo $(cat …) gymnastics.
Decode ID and access tokens: header, payload, registered claims, alg/kid sanity checks and warnings for common misconfigurations.
Point it at any /introspect endpoint, pick client auth (Basic, POST body, mTLS placeholder) and inspect the active/claims/scope response.
Fetch and validate /.well-known/openid-configuration: required fields, issuer mismatch, endpoint reachability and OAuth grant support at a glance.
Browse /.well-known/jwks.json keys, match a token’s kid to a key, and verify signatures locally with WebCrypto.
Visual iat/nbf/exp timeline with clock-drift analysis, so “token expired” vs “your clock is off” is settled in seconds.
Searchable reference of standard OIDC claims, scope-to-claim mappings and RP-facing hints from the spec — no PDF archaeology.
No accounts, no server-side storage — the tool runs where your tokens already are: in your browser.
Drop in a JWT or an opaque token. Decoding and claim analysis happen instantly, on the client.
Enter your issuer or discovery URL; the tool loads discovery and JWKS from your identity provider directly.
Structured results: validity, matched signing key, introspection response, and highlighted surprises in claims.