Entra Token Decoder
JWT decoder tuned for Entra ID: resolves tenant and app GUIDs to names, translates wids role IDs, explains every claim and shows expiry at a glance.
✓ runs 100% in your browser — no data leaves this pageFrequently asked
Is my token sent anywhere?
No — decoding is pure client-side WebAssembly. Still, treat access tokens like passwords and don't paste them into random websites. This one runs locally — check your browser's network tab: no request carries the token.
Why can't I decode my refresh token?
Entra refresh tokens are opaque (encrypted) — only access and ID tokens are JWTs you can inspect.
What does 'signature not validated' mean?
This tool inspects tokens, it doesn't verify them. Microsoft Graph tokens in particular cannot be validated by third parties.