Explore
Compare
Tools
Parameters
Step 1 of 9 Clicks "Sign in"
Step 1Clicks "Sign in"
The user starts the login in the client application.
How to use
What it shows
Each flow is drawn as a sequence diagram: the actors (user, client, servers) are columns and the messages are arrows over time. Press Play or ⏭ to step through it.
Edit it
Change the client_id, redirect_uri, scope, credentials, etc. and the diagram regenerates. Click any arrow to inspect the real HTTP request and its explanation.
Flows
Basic (username:password in Base64), Bearer/JWT, Authorization Code, Code + PKCE (recommended today), Implicit (legacy), Client Credentials (machine-to-machine), Device Code (TVs/CLI) and Refresh Token (renew without re-login).
Export and decode
On any step with an HTTP request you can copy it as a curl command to replay it in your terminal. If the step carries a JWT, open it in the JWT decoder to inspect its header and payload.
Attacks and MITM
Enable an attack to see an Attacker actor and the malicious steps (in red). Each flow brings its own: credential sniffing, alg:none, code interception without PKCE, PKCE with plain, CSRF from a missing state, mix-up, stolen refresh token, stolen DPoP token, device code phishing, AiTM or token passthrough in MCP. Enable the mitigation and the attack is neutralised (in green), showing why it fails. Attacks on the JWT itself (kid, jwk, typ…) are in the Authentication flow lab.
Compare
On the Compare tab you pick a flow on each side (or a preset pair) and they are drawn together. Equivalent steps line up on the same row (same /authorize, same /token…) so the difference stands out, and a summary lists which params and actors each one adds. Click any arrow to inspect it.
Tools
The Tools tab gathers practical OAuth utilities, all in the browser: generate and verify PKCE pairs (S256), build a copy-ready /authorize URL, parse a callback URL (extracts code/state or the fragment tokens and detects errors), audit an /authorize request against RFC 9700 and audit the server metadata (openid-configuration): which defences it advertises and which are missing.
