JWT & OAuth tools
Authentication debugging usually starts with a token or header that isn't behaving as expected: a JWT that won't verify, an OAuth redirect missing a parameter, or an Authorization header you need to construct by hand for a quick test. This page brings together JWT and JWK tooling, OAuth and OIDC URL building with PKCE, and header helpers for Basic and Bearer authentication.
The JWT debugger decodes claims as readable UTC dates and can verify a signature when you supply the key, while the OAuth / OIDC URL builder assembles a full authorization request with PKCE and can inspect the resulting callback. The OIDC Discovery viewer compares two providers' discovery documents side by side, which helps when migrating identity providers. Everything here runs locally on the token or URL you provide.
7 tools
All JWT / OAuth / Auth tools
-
JWT debugger
Decode JWT claims as UTC dates and verify signatures with explicit keys
-
JWK converter
Convert JWKS sets and PEM keys to JWK format with thumbprint validation
-
PKCE generator
Generate PKCE verifier and S256 challenge pairs for OAuth
-
OAuth / OIDC URL builder
Assemble OAuth authorization requests with PKCE and inspect callbacks
-
Authentication header helper
Generate Basic Auth headers and inspect Bearer token structure
-
OIDC Discovery viewer & validator
Validate OIDC discovery documents and compare endpoint configurations
-
SSH key inspector
Read OpenSSH public key algorithms and compute SHA256 fingerprints
JWT / OAuth / Auth tools FAQ
Yes — a JWT's header and payload are only base64url-encoded, not encrypted, so the JWT debugger can decode and display the claims immediately. Verifying the signature is different and requires the actual signing key or public key, which the tool only checks once you supply it.
PKCE stops an intercepted authorization code from being redeemed by an attacker, by requiring the original client to prove it holds a secret verifier. The PKCE generator here produces a verifier and its S256 challenge pair for testing an OAuth flow that requires it.
Basic Auth sends a base64-encoded username and password on every request, while a Bearer token is an opaque or structured credential, often a JWT, issued after a separate login step. The authentication header helper can generate a Basic Auth header and inspect the structure of an existing Bearer token.