What's the difference between an access token and a refresh token?

Access tokens are short-lived (minutes to hours) and sent with every API request. Refresh tokens are long-lived (days to months) and used only to obtain new access tokens when they expire.

Can it parse opaque tokens?

Opaque tokens have no parseable structure — they're just random strings. The tool can analyze JWT-structured OAuth tokens (signed JWTs) but cannot decode truly opaque tokens without calling the introspection endpoint.

What's PKCE and when do I need it?

PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks for public clients (SPAs, mobile apps) that cannot keep a client secret. It's required for all public OAuth clients per current best practice.

OAuth Tokenizer | DevTools Surf

DevTools Surf

Example: OAuth Tokenizer

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCIsImtpZCI6ImlkcC0yMDI2LTA5In0.eyJpc3MiOiJodHRwczovL2lkcC5hY21lLmV4YW1wbGUiLCJzdWIiOiJ1c3JfOGYzMWMwYTIiLCJhdWQiOiJodHRwczovL2FwaS5hY21lLmV4YW1wbGUiLCJjbGllbnRfaWQiOiJ3ZWItZGFzaGJvYXJkIiwiZXhwIjoxODIwMDAwMDAwLCJpYXQiOjE3ODkwMDAwMDAsImp0aSI6ImFjY180ZjJiMWQ3ZTkwIiwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBlbWFpbCBvZmZsaW5lX2FjY2VzcyByZWFkOm9yZGVycyB3cml0ZTpvcmRlcnMifQ.44fykUusOu4RPWYWBm74xdMEFunYjfnwDSVO2rVVWyhcubiEYt9i5fDTzDDrpzWPZ2kqM77_dsiJW6TI92dOaw

Output

═══ token 1 — Access token (RFC 9068 JWT profile) ═══
Algorithm: ES256
Key id: idp-2026-09
Header typ: at+jwt
Segments: 67c · 326c · 86c
Size: 481 bytes

─── Registered claims ───
iss: https://idp.acme.example
• Issuer — the authorization server that minted this token. Pin it exactly; never trust a token from an unexpected issuer.
sub: usr_8f31c0a2
• Subject — the stable, opaque id of the end user or service the token is about.
aud: https://api.acme.example
• Audience — the API that is allowed to accept this token. Your resource server must reject anything else.
exp: 2027-09-03T19:33:20Z (in 348 days)
• Expires at — a verifier must refuse the token after this instant.
iat: 2026-09-10T00:26:40Z (10 days ago)
• Issued at — when the authorization server created the token.
jti: acc_4f2b1d7e90
• JWT id — a unique id used for replay detection and revocation lists.

─── Scopes (6) ───
openid: Turns an OAuth request into an OpenID Connect one. Without it you get no ID token.
profile: Basic profile claims: name, family_name, given_name, picture, locale, updated_at.
email: The email and email_verified claims.
offline_access: Asks for a refresh token so the client can keep working when the user is away.
read:orders: Read-only access to orders.
write:orders: Create and modify orders. Implies read on most issuers, but do not assume it.
ℹ offline_access was granted, so a refresh token exists. Revoking the access token alone does not end this session.

─── Issuer-specific claims (1) ───
client_id: web-dashboard

─── Verdict ───
✓ Valid for another 348 days.
⚠ Lifetime of 359 days is long
…

About OAuth Tokenizer

OAuth Tokenizer preview - Security / Crypto tool

Decode OAuth 2 and OIDC tokens, explain every claim and scope, and name opaque ones. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Inspect and validate an OAuth access token or refresh token received from an authorization server.
Debug scope mismatches by parsing the scope claim before making an API call.
Verify token expiry and calculate time remaining before proactive refresh is needed.
Extract and inspect claims from an OpenID Connect ID token (JWT-based OAuth token).

Tips

Check the token_type field — 'Bearer' means the token is valid for any holder; 'DPoP' (Demonstration of Proof of Possession) means the token is bound to the caller's key.
Verify the scope claim to confirm that the token has the required permissions before attempting the API call — missing scopes produce 403 errors, not 401.
Parse the exp claim and compare against the current time before each API request to avoid using expired tokens — implement proactive refresh rather than handling 401s.

Fun Facts

OAuth 1.0 (2010) required complex HMAC request signing for every API call. OAuth 2.0 (2012) replaced this with Bearer tokens — much simpler but criticized for moving security responsibility to implementers rather than the protocol.
The OAuth 2.0 Authorization Code with PKCE (Proof Key for Code Exchange) flow, originally specified for mobile apps in RFC 7636 (2015), is now recommended for all OAuth clients including SPAs, replacing the implicit flow which was deprecated in 2019.
OAuth's name comes from 'Open Authorization' — the original design goal was to allow users to grant third-party apps access to their data without sharing passwords, a problem Twitter's API faced in 2006-2007.

FAQ

What's the difference between an access token and a refresh token?: Access tokens are short-lived (minutes to hours) and sent with every API request. Refresh tokens are long-lived (days to months) and used only to obtain new access tokens when they expire.
Can it parse opaque tokens?: Opaque tokens have no parseable structure — they're just random strings. The tool can analyze JWT-structured OAuth tokens (signed JWTs) but cannot decode truly opaque tokens without calling the introspection endpoint.
What's PKCE and when do I need it?: PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks for public clients (SPAs, mobile apps) that cannot keep a client secret. It's required for all public OAuth clients per current best practice.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder