Paste a JSON Web Token to instantly decode the header, payload and all claims — expiry time, user details, roles, scopes, tenant ID and more. Runs entirely in your browser, nothing sent anywhere.
A JSON Web Token (JWT) is a compact, self-contained way of securely transmitting information between parties. They are widely used in modern authentication — when you sign into Microsoft 365, Azure, an API, or any OAuth-based system, a JWT is issued to prove your identity and permissions. The token contains claims — statements about the user such as their email, roles, tenant ID, and when the token expires.
A JWT has three parts separated by dots: the header (algorithm and token type), the payload (the actual claims), and the signature (cryptographic proof). The header and payload are base64url encoded — not encrypted, just encoded — which means anyone can read the contents. The signature is what prevents tampering.
upn (user principal name), oid (object ID), tid (tenant ID), roles, scp (scopes), iss (issuer), aud (audience), exp (expiry), iat (issued at).
OAuth access tokens, Microsoft Graph API calls, Azure AD authentication, Conditional Access token inspection, API debugging, SSO troubleshooting.
The payload is readable by anyone — never put sensitive secrets in a JWT. Security comes from the signature: only the issuer can create a valid signed token, so the claims can be trusted.
Decoding happens entirely in your browser. Your token is never sent to any server. This is important — JWT tokens are credentials and should be treated with care.
The easiest way is via the Microsoft Graph Explorer at graph.microsoft.com — sign in, click the Access token tab, and copy the token. You can also capture tokens using browser DevTools (Network tab) while authenticated in the Azure portal or M365 admin centre.
exp is the expiry time, stored as a Unix timestamp (seconds since 1 January 1970). This tool converts it to a readable date and time, and flags the token as expired if the current time is past the exp value. Most Microsoft 365 access tokens expire after 1 hour.
Access tokens are used to call APIs — they contain scopes (scp) defining what the caller is allowed to do. ID tokens are used to authenticate a user — they contain identity information like name and email. Both are JWTs in Microsoft's implementation.
Yes — decoding happens entirely in your browser using JavaScript. Nothing is sent to any server. That said, treat access tokens like passwords — don't share them in public, and be aware they grant access to whatever scopes they contain until they expire.