[ Token Analyzer ]Docsdevanghacks.in

GitHub

Create a token
ghp_github_pat_gho_ghu_ghs_

Classic tokens publish their scopes in a response header, so the whole permission set is readable. Scopes are translated into the questions that matter: what it can change, what survives revoking it, and what it reaches beyond this account.

Legacy 40-character tokens too. Fine-grained and app tokens are read, but GitHub does not publish their permissions.

What it asks for

  • GET /useridentity, plus the X-OAuth-Scopes and X-GitHub-SSO headers
  • GET /user/orgsorganization membership
  • GET /user/reposrepositories, followed page by page through the Link header
  • GET /gistsgists, including secret ones

What it cannot tell you

  • Expiry cannot be read. GitHub returns it in a header it does not expose to browsers, so this page says "not reported" rather than guessing "never".
  • Fine-grained and app tokens do not publish their permissions anywhere. Establishing them would mean calling endpoints to see which succeed, which this tool will not do with a credential that may not be yours. They are judged by the repositories they open instead.
  • A secret gist is unlisted, not private: anyone with the link can read it. It is labelled Secret so it does not read as protected.