Does this tool contact the authorization server?
No. Every URL is parsed as text. Discovery, request_uri, JWKS, redirect, token, and userinfo endpoints are never requested.
OAuth / OIDC Flow Inspector
Inspect an OAuth 2.0 or OpenID Connect authorization request, compare an optional callback, PKCE verifier, ID Token, token response, and pasted discovery metadata without contacting the issuer.
Local input limit: 5 MB · Processing timeout: 10 s
How can I verify this?
Open your browser DevTools and the Network panel, optionally clear existing requests, then run the tool. Page assets or consent-based analytics may still load, but tool payloads, files, keys, and results are not sent for processing.
Inspect an OAuth or OpenID Connect flow
Start with an authorization URL. Add any callback, expected values, code_verifier, token response, or discovery JSON you already have. Every comparison runs locally; endpoints and request_uri values are never opened.
0.006 KB
Flow analysis
Request parameters, callback correlation, explicit state/nonce/PKCE results, nested tokens, discovery metadata, and findings will appear here.
Correlate OAuth artifacts without calling the issuer
DecodeLens preserves duplicate query and fragment parameters, compares only values you supplied, derives PKCE locally, and passes exact JWT/JWE/JSON children to focused tools through memory-only handoff.
Interpretation and verification boundaries
- No authorization, token, userinfo, discovery, request_uri, JWKS, redirect, or issuer URL is fetched or replayed.
- A matching state, nonce, PKCE, endpoint, or issuer value is only a supplied-value comparison; it does not prove server acceptance or session binding.
- JWT/JWE signatures, encryption, issuer trust, audience policy, client registration, and authorization decisions are not verified on this route.
- The V1 workspace analyzes one authorization request plus an optional callback and pasted/local supporting artifacts. It does not execute a login or token exchange.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Security & identity
PKCE Generator & Verifier
Generate RFC 7636 code verifiers and S256 challenges, or verify an existing verifier/challenge pair without persisting secrets.
Open tool - Security & identity
JWT Decoder & Parser
Parse JWT segments and inspect formatted Header, Payload, and Signature data locally.
Open tool - Security & identity
JWE Decoder & JOSE Inspector
Inspect JWE and JWS Compact segments, JWK or JWKS keys, embedded certificates, and RFC 7638 thumbprints without fetching remote key URLs.
Open tool - Security & identity
DPoP Proof JWT Inspector
Decode RFC 9449 DPoP proof JWTs, verify the embedded public JWK signature, and compare htm, htu, iat, ath, nonce, and token key binding locally.
Open tool
Authorization request to callback correlation
Load the example to compare state, nonce, PKCE, redirect_uri, discovery authorization endpoint, and ID Token issuer, then open the exact ID Token in JWT Inspector.
Flow artifacts
authorization URL + callback + code_verifier + token/discovery JSONExplicit comparisons
parameters → state/nonce/PKCE → exact token handoffs → findingsOAuth / OIDC Flow Inspector FAQ
Does a Match result mean the flow is secure?
No. It means only that the compared values supplied to DecodeLens are equal. Server-side storage, cookie binding, signature verification, client policy, and trust are separate checks.
Can I inspect the ID Token or Request Object?
Yes. Supported compact artifacts can be opened exactly in JWT or JOSE Inspector without putting their contents in the URL or browser storage.