Debugger
Identity protocol analyzer & debugger.
Paste or drop a token, a discovery document, an OAuth URL, a HAR trace of a login, SAML metadata or a SAMLResponse. You get every field explained in plain words, the API calls of each flow and the checks I would do in a review.
Designed and built by Antonio Braccolino · © 2026, all rights reserved
Input
How it worksTry with an example
- An issuer alone is enough: I add /.well-known/openid-configuration. For OAuth servers and APIs use the buttons below the field.
- Example data, generated in your browser.
Everything is decoded in your browser. Nothing you paste is sent anywhere; only the URLs you choose to load are requested, directly from your browser.
Result
How the debugger worksFour steps, what you can analyse, and how to trace a flow from your browser.
- 1Give it something
Paste text, upload a file or drag it onto the input panel. You can also load a .well-known URL.
- 2It recognises the format
Auto picks the right parser. If it guesses wrong, choose a tab: JWT, OIDC, OAuth URL, HAR, SAML or SCIM.
- 3Read “At a glance” and the checks
Key facts first, then the checks: red error, yellow warning, grey note. Each one says how to fix it and links to the spec.
- 4Go deeper
Every field is explained under its value. You also get the API calls of each flow, signature verification and the full JSON or XML.
What you can analyse
| Input | Where to find it | What you get |
|---|---|---|
| JWT (ID token, access token, logout token, DPoP proof) | Authorization header, token response, browser storage | Header and claims explained, expiry in local time, security checks, signature verification, check against the expected issuer and audience |
| OIDC / OAuth discovery, JWKS | https://issuer/.well-known/openid-configuration or oauth-authorization-server | Endpoints, all fields explained and grouped, about 30 configuration checks, flows with API calls (authorize, token, refresh, device, userinfo, logout), keys and certificates |
| Protected resource metadata (RFC 9728) | https://api/.well-known/oauth-protected-resource | Which authorization servers protect the API, how it accepts tokens, a button to load each server’s metadata |
| OAuth URL or token response | Address bar during login, Network tab | Authorize request, callback, error or logout explained parameter by parameter, PKCE, state and nonce checks |
| HAR file (browser trace) | DevTools, Network tab, export HAR | The whole login as a timeline: each request decoded, values compared between steps (state, PKCE, nonce, InResponseTo) |
| SAML metadata | IdP or SP metadata URL or file | EntityID, SSO, SLO, ACS and artifact endpoints with bindings, certificates with expiry and fingerprints, contacts, display info, checks on signing, encryption and default ACS |
| SAML request or response | SAMLRequest / SAMLResponse in the URL or form (SAML-tracer) | Decoded from Base64 or Deflate: status, NameID, conditions, attributes, signatures |
| X.509 certificate | PEM text or .cer / .der file | Subject, issuer, validity, key, fingerprints |
| SCIM 2.0 payload | Provisioning logs, API requests | Lint of User, Group, PatchOp, ListResponse and Error |
Trace a login from your browser (HAR)
A web page cannot see the traffic of your other tabs, and that is a good thing. So the tracer works like SAML-tracer, but from a recording you export yourself:
- Open the developer tools (F12, or Cmd+Option+I on Mac) on the tab of the app and go to Network.
- Turn on “Preserve log”, so redirects between sites are kept.
- Do the login (or the logout) from the start.
- Export: in Chrome and Edge the download icon or right-click → “Save all as HAR”; in Firefox right-click → “Save All As HAR”; in Safari “Export”.
- Drag the .har file onto the input panel, or pick the “HAR tracer” tab and upload it.
A HAR contains cookies, tokens and sometimes passwords. Here it is read only inside your browser and never uploaded, but do not send it to anyone as it is. Use test accounts when you can, and delete the file afterwards.