# JWT Decoder - Header, Claims, Expiry (Decode Only, No Keys) (`eliai/jwt-decoder`) Actor

Decode up to 50 JWTs per run: header, payload, iss/sub/aud, humanized iat/exp/nbf, expiry verdict, security warnings (alg=none, no-expiry, sensitive claims). Decode ONLY — signatures never verified, tokens never transmitted anywhere. $0.002 per token vs $0.02 measured incumbent; malformed free.

- **URL**: https://apify.com/eliai/jwt-decoder.md
- **Developed by:** [Broke to Built](https://apify.com/eliai) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.60 / 1,000 decoded jwts

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## JWT Decoder — Inspect Header, Claims & Expiry (Decode ONLY, No Verification)

Decode JWTs by API and get the facts as JSON: header, payload, standard claims (iss/sub/aud), humanized iat/exp/nbf timestamps, an expiry verdict, and security warnings (alg=none, missing expiry, year-long lifetimes, sensitive claims left in the payload). Up to 50 tokens per run, online, by API, or as an agent tool via Apify MCP.

**Read this first — what this tool is NOT:**

- **It does NOT verify signatures.** Every record carries `signatureVerified: false` and an explicit warning. A decoded token proves only what the token *claims*, not that it is authentic. Never use this output to make an authorization decision.
- **It does NOT transmit your tokens anywhere.** Decoding is pure local computation inside your own isolated Apify run — no third-party calls, no external services. Results land only in your run's dataset (private to your account), and the raw token is truncated in the output record.
- Still: treat live production tokens as credentials. Prefer decoding expired or test tokens when you can.

### What you get

- **header / payload** — fully decoded JSON
- **claims** — iss, sub, aud, plus ISO-formatted issuedAt / expiresAt / notBefore
- **timestamps** — each of iat/exp/nbf as `{iso, unix, relative}` ("in 3 days", "2 hours ago")
- **expired** — the bottom-line freshness verdict
- **warnings** — alg=none (forgeable), no exp claim, not-yet-valid, lifetime over a year, sensitive keys in the payload (password, api\_key, ssn...), and always: signature not verified
- **Fail-soft**: a malformed token never fails the run — it returns `{ok: false, error}` and is **never charged**.

### Input

```json
{ "jwt": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U" }
```

Bulk: `{ "tokens": ["...", "..."] }` (up to 50).

### Output (real run, trimmed)

```json
{
  "ok": true,
  "header": { "alg": "HS256", "typ": "JWT" },
  "claims": {
    "iss": "https://auth.example.com",
    "sub": "user-42",
    "aud": "api",
    "expiresAt": "2100-01-01T00:00:00.000Z",
    "issuedAt": "2018-01-18T01:30:22.000Z"
  },
  "expired": false,
  "signatureVerified": false,
  "warnings": [
    "Long-lived token: lifetime is ~29964 days (>1 year).",
    "Signature NOT verified: this tool decodes only, it does not validate the signature."
  ]
}
```

### Pricing

**$0.002 per token decoded.** No start fee. Malformed tokens are never charged.

Measured against the direct incumbent (2026-08-07): perryay/jwt-decoder-analyzer charges $0.02 per decode ($0.01 batch). One decode here is a tenth of that.

### Honest limits

- Decode only — by design. Verifying a signature requires your secret or public key, which you should not hand to any third-party tool; verify with your own JWT library where the key already lives.
- JWS compact serialization only (three dot-separated parts). Encrypted JWE tokens (five parts) report as malformed.
- Warnings are hygiene checks, not a security audit — a token can pass every check here and still be stolen, replayed, or signed with a leaked key.

### FAQ

**Why would I decode without verifying?**
Debugging ("why is this request 401ing?" — usually an expired or wrong-audience token), inspecting third-party tokens whose keys you don't hold, auditing what your own auth server puts in payloads, and CI checks on token lifetimes.

**Is it safe to paste a live token?**
The token is processed only inside your run and never sent to any external service; the output truncates the raw token. That said, a live token is a credential — the safest habit is decoding expired/staging tokens.

**What does the alg=none warning mean?**
`alg: none` means the token declares itself unsigned — anyone can mint one. Any system accepting such tokens is trivially compromised; the warning exists because these still show up in the wild.

**What sensitive claims are flagged?**
Keys like password, secret, api\_key, private\_key, access\_token, ssn, credit\_card, cvv, pin appearing in the payload — JWT payloads are readable by anyone who holds the token, so secrets do not belong there.

**Why did some rows come back `ok: false`?**
Not a structurally valid JWT (wrong part count, broken base64url, non-JSON segments). Recorded with the exact reason, never charged.

### Use from code or AI agents

```bash
curl -s "https://api.apify.com/v2/acts/EliAI~jwt-decoder/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"jwt": "<your-token>"}'
```

Agents: connect [Apify MCP](https://mcp.apify.com) and call the `EliAI/jwt-decoder` tool.

- **Capability:** decode one or many JWTs — header, claims, expiry verdict, security warnings; NO signature verification, NO external transmission
- **Required input:** `jwt`/`token` (string) or `tokens` (array)
- **Returns:** one record per token; `claims` + `expired` + `warnings` summarize it
- **Bounded:** 50 tokens per run; failures isolate per token
- **Side effects:** none (pure local decode)

# Actor input Schema

## `jwt` (type: `string`):

A single JSON Web Token to decode and inspect. No secret or signature verification needed.

## `tokens` (type: `array`):

Multiple JWTs to decode in one run. Each item is one token string.

## `maxItems` (type: `integer`):

Maximum number of tokens to decode in this run (cap).

## Actor input object example

```json
{
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "tokens": [],
  "maxItems": 50
}
```

# Actor output Schema

## `results` (type: `string`):

Every item this run produced, as JSON.

## `resultsCsv` (type: `string`):

The same items as a spreadsheet-ready CSV.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
};

// Run the Actor and wait for it to finish
const run = await client.actor("eliai/jwt-decoder").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" }

# Run the Actor and wait for it to finish
run = client.actor("eliai/jwt-decoder").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}' |
apify call eliai/jwt-decoder --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,eliai/jwt-decoder"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/57e7cMGt2zJZgtRl8/builds/JIMeH5ODhOCCzETM5/openapi.json