About this tool
Google service account authentication starts with a signed JWT: before your server can trade for an access token at the OAuth endpoint, it must build a claims set containing the service account email, the requested scope and a short expiry, and sign it with the account's RSA private key using RS256. This tool covers both halves of that debugging loop locally. Paste a service account JSON key file and the tool parses it and shows the safe-to-share fields — project_id, client_email and key IDs — plus a SHA-256 fingerprint of the private key so you can confirm which key you are holding without ever displaying it. Enter a scope and a lifetime and it generates a properly signed JWT grant, signed in your browser with the Web Crypto API and aimed at the standard oauth2.googleapis.com token audience. Already holding a token? Paste it into the decoder section to inspect the header and claims and see at a glance whether the exp claim is still valid or long expired. Everything happens client-side, which matters more than usual here: a service account private key is the keys to your GCP project, and the generated assertion can be exchanged for real Google API access — treat the output like a password and never share it.
How to use Service Account JWT Debugger
- Paste the full service account JSON key file downloaded from Google Cloud Console.
- Review the parsed, redacted summary — project, client email and key fingerprint — to confirm you have the right key.
- Enter the OAuth scope you need and pick a validity (Google accepts up to one hour).
- Generate the RS256-signed JWT grant, or paste an existing token below to decode it and check its expiry.
Frequently asked questions
Why does the tool warn about the generated token?
A signed JWT grant can be exchanged at Google's token endpoint for a real access token with the scopes you chose. Treat it like a password: do not share it, log it or commit it.
Is my private key shown or uploaded?
Neither. The tool displays only a SHA-256 fingerprint of the key so you can identify it, and the RS256 signing happens in your browser with the Web Crypto API. The key itself never leaves the tab.
What is the aud claim set to?
The grant is built for the standard OAuth token endpoint, https://oauth2.googleapis.com/token. For self-signed JWTs used directly against some Google APIs, the audience would instead be that API's base URL.
The decoder says my token is expired — what now?
Service account grants are short-lived by design (one hour maximum). Simply generate a fresh grant; Google rejects exchanges of expired assertions with an invalid_grant error.