TOOLBOX · TOOL
Decodea Token.
What is in a Microsoft Entra ID access token? Paste a token to read its header, payload and expiration, with explanations for each claim. Runs only in your browser.
Do not paste real tokens that are still valid. A valid access token acts like a password until it expires: anyone who has it can use it. This tool sends and stores nothing, but the clipboard, browser extensions and screen sharing can expose it. Use expired tokens or tokens from a test account.
Decodes as you type, only in your browser. We do not verify the signature.
HOW A JWT IS STRUCTURED
Three Parts.
Separated by Dots.
A JSON Web Token (RFC 7519) consists of three Base64url-encoded parts. Anyone with the token can read its header and payload; a signed JWT is not encrypted. Read about authentication in the glossary under Microsoft Entra ID and Single Sign-On.
- 01
Header
Algorithm (alg), type (typ) and identifier of the key (kid) used by the receiver to verify the signature.
- 02
Payload
Claims: who issued it (iss), who it applies to (sub), its audience (aud), expiration (exp), plus tenant, roles and permissions for Microsoft tokens.
- 03
Signature
Protects the header and payload against modification. Verification requires the issuer’s key.
Sources: RFC 7519 (JWT), RFC 7515 (JWS), RFC 7516 (JWE) and Microsoft Learn’s Access token claims reference and ID token claims reference.
WHAT TO WATCH FOR
Reading Is Easy.
Verification Takes More.
Decoding a token helps with troubleshooting. Its content is suitable for decisions only after the receiver verifies it.
- Anyone who possesses a bearer token can use it. Keep it out of page URLs, which appear in browsing history and server logs (RFC 6750, Section 5.3).
- A receiver defines permitted algorithms itself and checks issuer and audience, rather than trusting the header (RFC 8725).
- Microsoft recommends treating access tokens for other APIs as opaque strings; decoding is intended for troubleshooting (Microsoft Learn: Access tokens).
- Claims such as name, upn and preferred_username are for display only. For authorization, Microsoft specifies immutable identifiers such as oid and tid.
MORE ON MICROSOFT 365
Token Read.
Problem Found?
If sign-in fails earlier, the error code can help.
QUESTIONS
Good to Know.
Is my token sent to TOMORIS?
No. The decoder runs entirely in your browser. The token is sent neither to us nor to another service, and is neither placed in the URL nor stored; it disappears when the page closes. A token that is still valid acts like a password. Prefer expired tokens or tokens from a test account.
Does the decoder check whether a token is authentic?
No. It only displays the header and payload. Only the receiver can verify authenticity and integrity using the issuer’s public key, together with issuer, audience and lifetime checks. A decoder “confirming” a signature without securely knowing those keys would be misleading.
What do exp, nbf and iat mean?
These are times in seconds since January 1, 1970 (UTC), as defined by RFC 7519. exp is expiration, nbf the start of validity, and iat the time of issue. The decoder converts them to Vienna local time and shows how long the token remains valid.
Why can my Microsoft token not be decoded?
Not every Microsoft token is a readable JWT. Microsoft says tokens for Microsoft services have their own format and may be encrypted, and applications should treat access tokens as opaque strings. An encrypted token (JWE) has five parts instead of three; only the header is readable.
What is dangerous about alg “none”?
A token with alg “none” is unsigned. Modifications go undetected. RFC 8725, the IETF recommendations for JWTs, allows this only if the token is cryptographically protected by other means. A receiver should define permitted algorithms itself and reject all others.
YOUR NEXT STEP
You Have the Result.
What Comes Next?
We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.