JWT Decoder — Inspect Header, Claims & Expiry (Decode ONLY, No Verification)

Decode JWTs by API and get the facts as JSON: header, payload, standard claims (iss/sub/aud), humanized iat/exp/nbf timestamps, an expiry verdict, and security warnings (alg=none, missing expiry, year-long lifetimes, sensitive claims left in the payload). Up to 50 tokens per run, online, by API, or as an agent tool via Apify MCP.

Read this first — what this tool is NOT:

• It does NOT verify signatures. Every record carries signatureVerified: false and an explicit warning. A decoded token proves only what the token claims, not that it is authentic. Never use this output to make an authorization decision.
• It does NOT transmit your tokens anywhere. Decoding is pure local computation inside your own isolated Apify run — no third-party calls, no external services. Results land only in your run's dataset (private to your account), and the raw token is truncated in the output record.
• Still: treat live production tokens as credentials. Prefer decoding expired or test tokens when you can.

What you get

• header / payload — fully decoded JSON
• claims — iss, sub, aud, plus ISO-formatted issuedAt / expiresAt / notBefore
• timestamps — each of iat/exp/nbf as {iso, unix, relative} ("in 3 days", "2 hours ago")
• expired — the bottom-line freshness verdict
• warnings — alg=none (forgeable), no exp claim, not-yet-valid, lifetime over a year, sensitive keys in the payload (password, api_key, ssn...), and always: signature not verified
• Fail-soft: a malformed token never fails the run — it returns {ok: false, error} and is never charged.

Input

{ "jwt": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U" }

Bulk: { "tokens": ["...", "..."] } (up to 50).

Output (real run, trimmed)

{
  "ok": true,
  "header": { "alg": "HS256", "typ": "JWT" },
  "claims": {
    "iss": "https://auth.example.com",
    "sub": "user-42",
    "aud": "api",
    "expiresAt": "2100-01-01T00:00:00.000Z",
    "issuedAt": "2018-01-18T01:30:22.000Z"
  },
  "expired": false,
  "signatureVerified": false,
  "warnings": [
    "Long-lived token: lifetime is ~29964 days (>1 year).",
    "Signature NOT verified: this tool decodes only, it does not validate the signature."
  ]
}

Pricing

$0.002 per token decoded. No start fee. Malformed tokens are never charged.

Measured against the direct incumbent (2026-08-07): perryay/jwt-decoder-analyzer charges $0.02 per decode ($0.01 batch). One decode here is a tenth of that.

Honest limits

• Decode only — by design. Verifying a signature requires your secret or public key, which you should not hand to any third-party tool; verify with your own JWT library where the key already lives.
• JWS compact serialization only (three dot-separated parts). Encrypted JWE tokens (five parts) report as malformed.
• Warnings are hygiene checks, not a security audit — a token can pass every check here and still be stolen, replayed, or signed with a leaked key.

FAQ

Why would I decode without verifying? Debugging ("why is this request 401ing?" — usually an expired or wrong-audience token), inspecting third-party tokens whose keys you don't hold, auditing what your own auth server puts in payloads, and CI checks on token lifetimes.

Is it safe to paste a live token? The token is processed only inside your run and never sent to any external service; the output truncates the raw token. That said, a live token is a credential — the safest habit is decoding expired/staging tokens.

What does the alg=none warning mean? alg: none means the token declares itself unsigned — anyone can mint one. Any system accepting such tokens is trivially compromised; the warning exists because these still show up in the wild.

What sensitive claims are flagged? Keys like password, secret, api_key, private_key, access_token, ssn, credit_card, cvv, pin appearing in the payload — JWT payloads are readable by anyone who holds the token, so secrets do not belong there.

Why did some rows come back ok: false? Not a structurally valid JWT (wrong part count, broken base64url, non-JSON segments). Recorded with the exact reason, never charged.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~jwt-decoder/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"jwt": "<your-token>"}'

Agents: connect Apify MCP and call the EliAI/jwt-decoder tool.

• Capability: decode one or many JWTs — header, claims, expiry verdict, security warnings; NO signature verification, NO external transmission
• Required input: jwt/token (string) or tokens (array)
• Returns: one record per token; claims + expired + warnings summarize it
• Bounded: 50 tokens per run; failures isolate per token
• Side effects: none (pure local decode)