ToolsWeb & certificates

Entra ID token and sign-in reader

Paste something from a failed or suspicious Microsoft 365 sign-in: an Entra access or ID token, an AADSTS error, or a sign-in log. You get a plain-English explanation of who, what, why it failed and who usually fixes it.

Read in your browser: what you paste is never uploaded

What you have

Paste a token, an error or sign-in log JSON

Detected automatically. A token (three parts starting eyJ), an AADSTS code or the whole error text, or JSON from Sign-in logs > Download JSON or GET /auditLogs/signIns.

What it is

Check a token's signature (optional)

Tenant signing keys (JWKS JSON)

Open the tenant's keys address (the jwks_uri in its OpenID Connect discovery document) in a browser yourself and paste what it shows. This page doesn't fetch it. Tokens issued for Microsoft Graph can't be checked this way.

A token is a password for as long as it is valid.

This page reads it on this device only and sends nothing. Even so, prefer an expired or test token, and ask an admin to revoke the user's sign-in sessions if a live token was pasted anywhere else.

How this works

It looks at what you pasted and picks one of three readers: a JWT (three dot-separated parts starting eyJ), an AADSTS error (an AADSTS code or number, or an error body), or JSON with sign-in events. You can override the choice.
Token: it decodes the header and claims with the same code as the JWT decoder, then explains the Entra-specific ones: token kind, v1.0 or v2.0, tenant, user, audience, client app, authentication methods, directory roles, dates and findings.
Error: it extracts the code, trace ID, correlation ID and timestamp, and looks the code up in a table paraphrased from Microsoft Learn. A code that isn't in the table gets links to Microsoft's pages and says so.
Sign-in log: it reads each event, tolerating missing fields, and writes a narrative and a table: who, app, device, location, Conditional Access policies and results, authentication steps, risk and IDs to quote in a support case. At most 500 events are read.

What's kept: nothing. Nothing you paste is sent anywhere, stored or put in the page address, and no request is made.

Limitations:

The signature is not verified unless you paste the tenant's key set. Without that, a token could be forged and still be explained here.
The error and role tables hold the entries confirmed against Microsoft Learn. Microsoft changes them, and an unlisted code isn't invalid.
A token doesn't show everything. For instance, amr is optional in v2.0 tokens, so MFA often can't be known from the token alone.
This page can't tell whether an IP address or device is new for a user: the log events don't say.

Code: entra.js (this page), entra.js (reading tokens, errors and logs), entracodes.js (the AADSTS, role and app tables), jwt.js (decoding and signatures).