oidc id token forensic analyzer — free browser tool | fatcousin

drop oidc id_token + userinfo · parse claims + acr + auth_time · timeline + findings export · runs locally

input

drop id_token jwt + userinfo json

id_token · userinfo · token response bundle · multiple files

Select file

optional expected aud / client id (aud mismatch check)

parses iss sub aud exp iat auth_time acr amr nonce at_hash · flags expired exp · aud mismatch · auth_time drift · missing acr for step-up hints

limits

jwt decode only — no signature verify against live jwks · heuristic screener · not definitive proof

status

>ready