DPoP Proof & Header Debugger

Generate and inspect RFC 9449 DPoP proof JWTs — ephemeral EC keys, htm/htu/ath binding, and header claim checks. Client-side WebCrypto only.

Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Build and inspect OAuth 2.0 DPoP proofs (RFC 9449) with ephemeral ES256 keys. Keys and tokens never leave this tab.

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

Query and fragment are stripped per RFC 9449.

—

RFC 9449 proof goes in the DPoP HTTP header.

—

Present when an access token was provided (Authorization: DPoP <token>).

—
—
—

What is DPoP?

DPoP (Demonstrating Proof-of-Possession) binds access tokens to a client-held key by attaching a signed JWT proof to HTTP requests (RFC 9449).

This debugger builds proofs with ephemeral EC P-256 keys and inspects DPoP headers for required claims and embedded public JWKs — entirely in the browser.

How to use this tool

  1. Generate or paste an EC P-256 private JWK, set HTTP method and target URL, optionally add an access token for ath.
  2. Build the proof and copy the DPoP header (and Authorization: DPoP when applicable).
  3. Paste an incoming DPoP JWT into the inspector to decode claims and verify the signature against the header jwk.

Frequently asked questions

Are DPoP keys uploaded?

No. Key generation, signing, and verification use WebCrypto and jose in this tab only.

Which algorithm is supported?

ES256 with EC P-256 keys, matching the common DPoP profile used by OAuth 2.1 deployments.