Advanced JWT diagnostics
OIDC Discovery Checker
Check OpenID Connect or OAuth authorization-server metadata from an issuer URL, validate exact issuer matching and inspect JWKS and endpoint metadata in your browser.
The request runs from your browser with credentials omitted. Some providers do not allow CORS even when their metadata is valid.
How discovery validation fits into JWT verification
OIDC Discovery publishes issuer, authorization_endpoint, jwks_uri and supported capabilities. The returned issuer must exactly match the issuer used for discovery.
OAuth RFC 8414 uses a different well-known path rule when an issuer contains a path component. The checker builds the URL according to the selected mode.
Only the discovery URL you request is fetched. Credentials are omitted and the response is not sent to a JWTDecoder.tools API.
Related advanced tools
JWT Security Analyzer
Inspect a JWT for policy-sensitive security signals such as alg=none, unexpected algorithms, token-controlled key URLs, suspicious kid values, time claims, issuer and audience mismatches.
JWT Diff
Compare two JWTs field by field to see what changed in the decoded header and payload after refresh, login, environment changes or key rotation.
JWK Inspector
Inspect a single JSON Web Key, identify key type and usage metadata, detect private key material and compute an RFC 7638 SHA-256 JWK thumbprint locally.