JWT Decoder — inspect tokens without verifying

JWT Decoder API

What it does

JWT Decoder decodes and inspects a JSON Web Token without verifying its signature. Send a single token string in the request body, and get back a structured JSON response for reading the token header, payload, and claims.

Use it when you need to debug authentication flows, inspect tokens from a client or gateway, or check what data is embedded in a bearer token before you wire up verification logic. Because it only decodes the token, it is useful for quick inspection during development and troubleshooting.

The input is a three-part JWT in base64url form. The service does not ask for keys or secrets, and it does not perform signature validation. That makes it a lightweight utility for looking at token contents, not for trusting them.

JWT Decoder fits into backend tooling, auth diagnostics, and API support workflows wherever you need to read a token’s structure fast.

What you'll get back

Returns the decoded header and payload, the signing algorithm, human-readable timestamps for standard claims, and an expired flag — all without verifying the signature.

{
  "header": {
    "alg": "HS256"
  },
  "payload": {
    "sub": "1"
  },
  "algorithm": "HS256",
  "type": null,
  "signature": "sig",
  "readable_claims": {},
  "expired": null,
  "seconds_until_expiry": null,
  "verified": false,
  "note": "Signature is NOT verified. This tool only decodes the token."
}

About this endpoint

What it does

Decodes a JWT without verifying its signature and returns the header, payload, algorithm, readable claims, and expiry status. The request body contains the JWT as a token string.

Request Body

Parameter	Type	Mandatory	Description
token	String	Yes	The JWT to decode as three dot-separated base64url segments.

Response

Field	Type	Description
header	Object	The decoded JWT header (e.g. `alg`, `typ`).
payload	Object	The decoded JWT payload/claims, as submitted in the token.
algorithm	String	The signing algorithm declared in the header (e.g. `HS256`).
type	String or null	The token type declared in the header (`typ`), if present.
signature	String	The raw (unverified) signature segment of the token.
readable_claims	Object	Standard registered claims (`iat`, `nbf`, `exp`) converted to readable ISO timestamps, when present in the payload.
expired	Boolean or null	Whether the token's `exp` claim has passed. `null` if no `exp` claim is present.
seconds_until_expiry	Integer or null	Seconds remaining until expiry. Negative if already expired, `null` if no `exp` claim is present.
verified	Boolean	Always `false`. Signature verification is never performed.
note	String	Reminder that the signature is not verified and no secret is used.

Body

Name

Type

Description

bodyREQUIRED

object

—

JWT Decoder API

What it does

Quickstart

What you'll get back

About this endpoint

What it does

Request Body

Response

Body

Errors any endpoint can return