WebChecks

JWT Decoder

Paste a JSON Web Token to read its header and claims, with Microsoft Entra ID (Azure AD) claims, role GUIDs and app IDs resolved to names. Decoding happens entirely in your browser.

Decoding makes no network requests. The token is parsed here, in this page, and is never sent anywhere — not to this site, not to anyone. Verifying a signature is a separate step you have to press: it fetches only the public keys published by the issuer the token names. The token itself is still never transmitted.
Decodes as you type. There is no submit button and nothing to send.

Before you paste anything

Treat access tokens as credentials. A valid token is a bearer credential: anyone holding it can act as its subject until it expires. Avoid pasting production tokens into any tool you have not verified for yourself — including this one. The whole of the decoding logic runs in the JavaScript this page already sent you, so you can watch it in your browser's network tab and see that nothing leaves.

Verifying a signature confirms only that it matches the keys published by the issuer the token claims to come from. It does not establish that the issuer should be trusted, and it checks neither the audience nor the expiry against any policy of yours — a token can verify perfectly and still be the wrong token for your API.

Working out which Microsoft Graph permissions a scope in this token actually grants, or which ones an app would need for a given task? Graph Permissions Finder resolves that from Microsoft's own published operation-to-permission mapping.