Security
Processed locally in your browser — not uploaded
OAuth DPoP Proof Debugger
Inspect OAuth Demonstrating Proof of Possession JWTs against the HTTP method and target URI they protect. Validate required claims, proof freshness, ath access-token binding, embedded public JWK safety, and supported cryptographic signatures entirely in the browser.
Sensitive values stay local · ES256, RS256, and PS256 verification supported
Paste a proof to validate its JWT structure, request binding, freshness, and signature.
01
How to use
- Paste a DPoP proof JWT and enter the exact HTTP method and target URI it accompanied.
- Optionally paste the associated access token to verify the ath claim; all values remain in the browser.
- Review structural, request-binding, freshness, access-token hash, and cryptographic signature checks separately.
02
Understanding the output
The debugger validates core RFC 9449 proof properties and verifies ES256, RS256, or PS256 signatures using the embedded public JWK. It does not contact the authorization server or detect server-side replay.
03
Common issues & tips
- •The htu claim must match the request URI with its fragment removed; proxy rewriting or signing a different public URL causes mismatches.
- •A valid signature is not sufficient: servers must also enforce freshness, nonce policy, unique jti values, and key binding.
Frequently asked questions
- Which DPoP signature algorithms can the debugger verify?
- It verifies ES256, RS256, and PS256 with the browser Web Crypto API. It still decodes other algorithms but reports signature verification as unsupported.
- Does a passing proof guarantee that a request is authorized?
- No. The resource server must also validate the access token, nonce policy, replay protection, accepted algorithms, URI rules, and confirmation-key binding.
- Are the proof and access token uploaded?
- No. Decoding, hashing, and signature verification happen entirely in your browser.