Entra ID Token Decoder

Paste a JWT. You get every claim explained, wids resolved to real directory role names with privileged roles flagged, the expiry checked against your clock, and a warning for the traps that break token validation.

Where to get a token

Connect-MgGraph -Scopes "User.Read.All"
# Graph SDK v2 does not expose the raw token; use MSAL directly:
$t = Get-MsalToken -ClientId "14d82eec-204b-4c2f-b7e8-296a70dab67e" -TenantId "contoso.onmicrosoft.com"
$t.AccessToken | Set-Clipboard

Or take it from the Authorization header in your browser's network tab, or from Graph Explorer's Access token tab.

Three things this will save you

The Graph token you cannot validate. If the token's header contains a nonce, it is a Microsoft Graph access token. Graph rewrites the token before signing, so no library on earth will validate that signature. Request a token for your own API instead.

Using the wrong claim as a key. upn, preferred_username, email and name are all mutable and none is guaranteed unique. Key on oid plus tid.

Missing the group overage. A user in enough groups gets hasgroups instead of the group list. Code that reads groups directly quietly stops working for exactly the users who are in the most groups.