Decode JWT headers and payloads without verification claims.
This tool decodes JWT content locally in your browser. It does not verify the signature or prove the token is trustworthy.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "codesphere-demo",
"name": "CodeSphere Demo",
"iat": 1767225600,
"exp": 4102444800
}Signature section length: 9 characters.
Paste a JSON Web Token to inspect its decoded header and payload, read registered time claims, and quickly spot expired tokens. The decoder is intentionally local and inspection-only: it never uploads the token and never claims a signature is valid.
The decoder splits a JWT into its base64url header and payload sections, converts the JSON locally, and formats registered time claims such as `exp`, `iat`, and `nbf` for inspection.
Example: Pasting an access token can reveal its algorithm label, issuer, subject, and expiration timestamp without sending the token to Codesphere.
Decoding does not verify the signature, issuer, audience, encryption, or revocation status. Treat every displayed claim as untrusted data and never paste production secrets into third-party tools unnecessarily.
No. It only decodes the header and payload so you can inspect them. It does not validate trust, issuer, audience, or signature.
No. JWT decoding runs locally after the page loads, and token input is not stored in the URL.
The decoder recognizes exp, iat, and nbf numeric claims and shows ISO time plus expired or not-before status where applicable.
Was this useful?