Entra ID Token Decoder

Decode a Microsoft Entra ID (Azure AD) access or ID token: audience, client app, scopes, roles and expiry explained
Paste the token with or without the "Bearer " prefix. The signature is not validated.

The token is decoded in your browser and never leaves this page. Treat tokens like passwords anyway: prefer expired tokens or tokens from a test tenant.

Troubleshooting a 401 or 403? Compare the audience with the API you call, check that the scope or role you need is listed, and make sure the token hasn't expired.

Link to this page

Found this useful? Copy a ready-made link for your blog, wiki, documentation or forum answer.

HTML

<a href="https://vitextra.com/en/tools/token-decoder">Entra ID Token Decoder</a>

Markdown

[Entra ID Token Decoder](https://vitextra.com/en/tools/token-decoder)

Citation

Entra ID Token Decoder. Vitextra Free Tools for Microsoft 365. https://vitextra.com/en/tools/token-decoder

How it works

A JSON Web Token consists of three Base64URL-encoded parts separated by dots: header, claims and signature. The tool decodes the first two and explains the claims added by Microsoft Entra ID.

  1. Get a token

    Copy it from the Authorization header in the browser developer tools, the Access token tab of Graph Explorer, Postman, or az account get-access-token.

  2. Decode it here

    The header and claims are Base64URL-decoded locally. Nothing is uploaded and nothing is logged.

  3. Read the claims

    See which API the token is for, which app requested it, what it allows and when it expires. App and directory role IDs open in the App ID Lookup.