Compare two credentials#

Two credentials that should behave the same way often differ in one field. To find that field, you have to read both, which is slow. Compare decodes each side, flattens both into paths, and lists what changed.

It is the mode for the question 'this token works and this one does not, why'.

Load each side#

Paste into either pane, Token A or Token B, the way you do in Decode. You can also use the picker on each pane to pull an entry out of History. The picker is usually faster, because the credential you want to compare against is normally one you looked at moments ago.

Each pane detects its own protocol and shows it as a chip. An entry from History carries its protocol across, which matters for opaque tokens that detection alone cannot classify.

Read the diff table#

A status of Added, Removed, or Changed marks every field that differs. Rows that match carry no status.

The order is the useful part. Differences come first. Within them, the table lifts the fields that govern behaviour to the top: the algorithm, issuer, audience, subject, scopes and roles, expiry, the PKCE parameters, key size, and whether a certificate is self-signed. A changed alg never sits below a changed display name.

The table hides matching rows by default, so it shows only what moved. The footer counts the changes, and it offers a toggle to show the unchanged rows when you need the full picture.

The table adds a relative reading beside each raw timestamp, so an exp shows as in 60m or 3h ago and you do not have to convert it.

Severity counts and mismatched protocols#

The audit runs on both sides, and the severity counts appear in each column header. Compare a credential before and after a change, and you see whether it got safer, not only whether it got different.

If the two sides use different protocols, a banner says so. The comparison still runs, but nearly every row differs. Treat that as a sign you loaded the wrong credential, not as a useful result.