Skip to content


Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Implicit Flow Detector

TL;DR: This browser extension is now available in both the Google Chrome Webstore and the Firefox Addons.

This browser extension detects websites that use the implicit flow. It does this by scanning urls and looking for id_token and/or access_token in the url.

It works on both Firefox and Chrome. It should work on chromium variants. It doesn't work on Safari.

If the implicit flow is detected, the site url will be added to a tree view in the extension popup. Expanding that tree shows you the token contents. It also shows a yellow indicator for the presence of an id token and a red indicator for the presence of an access token.

The code is vanilla javascript. There is one dependency: browser-polyfill.js, which makes chrome adhere to the standard for browser extensions that mozilla has proposed. This enables it to be a single codebase that works in both chrome and firefox.

Run locally

Install web-ext with:

npm install --global web-ext

Launch firefox and chrome to test:

web-ext run -t chromium -t firefox-desktop

Install in Browsers

The extension is available for Google Chrome and Firefox.

You can also install it locally by following these instructions:


Click the hamburger menu in the upper right. Select Add-ons. Click the gear icon. Select Debug Add-ons. Click Load Temporary Add-on.... Select the file.


Click the vertical three dots in the upper right. Select More tools > Extensions. Click the Developer mode slider mode in the upper right. Click the Load unpacked button. Select the folder this README is in.

See it in Action

  1. The icon for the extension is a blue hash symbol. Navigate to:
  2. Uncheck code and check id token and access token
  3. Click the link the at the bottom of the page
  4. Notice that the extension icon changes from blue to red to indicate that an implicit flow has been detected
  5. Click the red hash icon and you'll see in the list

implicit detector


You can see additional sites added to the implicit flow detector by going to: Implicit Flow playground and/or Medium post on Implicit Flow.

NOTE: If you do the example, you'll see that they use an opaque access token and a JWT ID Token. The browser add-on represents these accordingly. It should work with any site that uses the implicit flow.

Good sites for testing

The following urls use the implicit flow and will result information showing in the browser extension:

Building for Release

Next Steps

  • Show a badge with the number of sites detected
  • cleanup iconography and style
  • show the raw tokens in popup
  • show "yellow alert" icon if only id token is detected
  • show "red alert" icons if access token is detected
  • if token(s) are jwts, show claims
  • pretty print claims if present


A browser extension for Chrome and Firefox to detect the deprecated OAuth 2.0 Implicit flow




Code of conduct





No packages published