Azure AD / Entra ID JWT Decoder
Paste an Azure AD access token or ID token to inspect its tenant ID, object ID, scopes, app roles, and user claims. Verify the RS256 signature using the Microsoft identity platform JWKS.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Azure AD / Entra ID JWTs
Microsoft Entra ID (formerly Azure Active Directory) issues two JWT versions: v1.0 and v2.0. The version is indicated by the ver claim. v2.0 tokens are issued by the /v2.0 endpoint and use scp for delegated scopes and roles for application permissions. v1.0 tokens use the same claims but with slightly different formatting. The iss claim tells you which endpoint issued the token.
Azure AD tokens are signed with RS256 and the public keys are available from the OpenID Connect discovery document at https://login.microsoftonline.com/<tenantId>/v2.0/.well-known/openid-configuration. The jwks_uri field in that document points to the JWKS. Match the kid in the JWT header to find the correct verification key.
Key tenant-specific claims include tid (the Azure AD tenant ID), oid (the immutable object ID of the user or service principal — use this as your user's stable identifier), and upn (the user principal name, typically an email address). App roles assigned to a user or service principal appear in the roles array. Paste a token above to decode all of these.
Common Entra ID claims
tidTenant ID — the Azure AD tenant that issued the token.
e.g. 72f988bf-...
oidObject ID — stable, immutable identifier for the user or service principal.
e.g. a4d2f3b1-...
upnUser Principal Name — typically the user's email address.
e.g. jane@contoso.com
scpDelegated scopes granted to the client application.
e.g. User.Read Mail.Read
rolesApplication roles assigned to the user or service principal.
e.g. ["Admin"]
appidApplication (client) ID of the calling application.
e.g. 00000003-...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.