Free tool · runs in your browser

OAuth / OIDC Inspector

Inspect an authorization URL, callback, token request or OAuth/OIDC metadata, with Web Crypto PKCE S256 generation.

Local processing No data sent No account Tokens and federation

Inspect an OAuth/OIDC artefact

Authorization or callback URL, form-encoded parameters, or JSON metadata. No endpoint is contacted.

Examples

Transaction generator

Web Crypto generates 32 random bytes for each value. Nothing is retained after the tab closes.

PKCE code_verifier
PKCE code_challenge (S256)
state
OIDC nonce

What is the difference between OAuth and OpenID Connect?

OAuth 2.0 delegates access to an API without giving the user password to the client. OpenID Connect adds an identity layer and a signed ID Token. In a modern flow, Authorization Code with PKCE binds the code to the client that started the transaction; state and nonce also bind the response to its context.

Authorization Code with PKCE

The client creates a random code_verifier and sends only its SHA-256 digest, the code_challenge. At exchange time, the authorization server rejects the code when the verifier does not match. RFC 9700 requires PKCE for public clients and recommends it for confidential clients too.

What the review does not prove

A correct URL does not show whether the server actually verifies redirect_uri, state, nonce, audience or PKCE. The tool reviews an artefact; an authorised integration test must still exercise server responses.

?Frequently asked questions

Does the tool download metadata or the JWKS?

No. URLs are only displayed and checked syntactically. No fetch, automatic discovery or key validation takes place.

Can the code_verifier be shared?

No. The challenge can be sent in the authorization request, but the verifier remains secret until the code exchange. Generate a new pair for every transaction.

Why are state and nonce separate?

state binds the OAuth response to the client transaction and can carry an opaque identifier. nonce is repeated in the OIDC ID Token and binds that token to the transaction.

+More tools

{·}
JWT Inspector
Decode a JWT, verify its signature, spot weaknesses.
</>
SAML Decoder
Decode a SAML request or response and spot weaknesses.
API
OpenAPI Auditor
Inventory routes, authentication schemes and weaknesses in an API contract.

Technical assessment

Request an application or infrastructure assessment

For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.

Discuss my project Compare solutions