WebChecks

JWT Decoder

Paste a JSON Web Token to read its header and claims, with Microsoft Entra ID (Azure AD) claims, role GUIDs and app IDs resolved to names. Decoding happens entirely in your browser.

Decoding makes no network requests. The token is parsed here, in this page, and is never sent anywhere — not to this site, not to anyone. Verifying a signature is a separate step you have to press: it fetches only the public keys published by the issuer the token names. The token itself is still never transmitted.
Decodes as you type. There is no submit button and nothing to send.

Before you paste anything

Treat access tokens as credentials — anyone holding a valid one can act as its subject until it expires, so be careful where you paste production tokens, including here. Decoding runs entirely in the JavaScript this page already sent you, so you can watch your browser's network tab and see that nothing leaves. Verifying a signature confirms only that it matches the keys published by the issuer the token claims to come from — it checks neither the audience nor the expiry against any policy of yours.

Working out which Microsoft Graph permissions a scope in this token actually grants? Graph Permissions Finder resolves that from Microsoft's own published operation-to-permission mapping.