Decode and inspect OAuth 2.0 access tokens and OIDC ID tokens. Analyse scopes, claims, expiry, and detect authentication misconfigurations.
Generate a PKCE pair for the Authorization Code with PKCE flow. The verifier is sent at token exchange; the challenge is sent at authorization.
Related free tools
Decode a JWT, inspect claims and expiry, and check for weak or missing signature algorithms.
Generate a code verifier and S256 challenge for testing authorization-code flows.
Decode SAML requests and responses to read assertions, conditions and signatures.
Read next
Redirect URI tricks, missing state, implicit-flow leaks and token misuse — with the checks that prevent each.
AquilaX SAST and API Security scanners trace how tokens are validated in your code — missing audience checks, alg:none acceptance, unbounded expiry, redirect URIs built from user input — and open the fix PR.
Free plan is permanent · unlimited scans · GitHub, GitLab, Bitbucket & Azure DevOps