AWS Presigned URL Inspector
Inspect SigV4 credential scope, signed headers and expiration without requesting the URL
The tool does not request the URL and cannot verify signature correctness without AWS credentials.
Credential scope, signing time, expiry, and SignedHeaders will appear here.
About this tool
AWS Presigned URL Inspector parses SigV4 query parameters from S3 and other AWS service URLs without making a request. It separates the access key identifier from its credential scope, reports region and service, lists signed headers, converts X-Amz-Date to an exact timestamp, and calculates expiration from X-Amz-Expires. Sensitive query values are masked in the interface. Expiration can be assessed locally, but signature validity cannot be proven without the signing secret and canonical request context.
Scenario Recipes
Triage an S3 link reported as expired
Goal: Separate timestamp problems from signature or policy problems
- Paste the complete presigned URL without requesting it.
- Compare signed-at and expires-at values with the current status.
- If time remains valid, investigate credentials, session expiry, policy, object path, and canonical signing inputs.
Result: A timestamp and credential-scope report that narrows the AWS investigation.
Frequently Asked Questions
Does the inspector open or download the presigned URL?
No. It only parses the URL text already pasted into the browser.
Can it verify the AWS signature?
No. Cryptographic verification requires the signing secret and exact canonical request context, which should not be pasted into a web tool.
How is the expiration time calculated?
X-Amz-Expires seconds are added to the UTC X-Amz-Date signing timestamp.
What is the maximum SigV4 presigned URL duration?
AWS services commonly cap SigV4 query authentication at 604800 seconds, or seven days, though service rules can be stricter.
Why is an unexpired URL still rejected by AWS?
Credentials may be revoked, temporary credentials may expire earlier, policy can deny access, the object can change, or the signature may be invalid.
Is the URL stored or uploaded?
No. Parsing and expiration calculations occur locally, and sensitive parameter values are masked in the report UI.
Keep browsing