JWT Decoder API - Header, Claims & Expiry, Decode Only

JWT Decoder — Inspect Header, Claims & Expiry (Decode ONLY, No Verification)

Decode JWTs by API and get the facts as JSON: header, payload, standard claims (iss/sub/aud), humanized iat/exp/nbf timestamps, an expiry verdict, and security warnings (alg=none, missing expiry, year-long lifetimes, sensitive claims left in the payload). Up to 50 tokens per run, online, by API, or as an agent tool via Apify MCP.

Read this first — what this tool is NOT:

• It does NOT verify signatures. Every record carries signatureVerified: false and an explicit warning. A decoded token proves only what the token claims, not that it is authentic. Never use this output to make an authorization decision.
• It does NOT transmit your tokens anywhere. Decoding is pure local computation inside your own isolated Apify run — no third-party calls, no external services. Results land only in your run's dataset (private to your account), and the raw token is truncated in the output record.
• Still: treat live production tokens as credentials. Prefer decoding expired or test tokens when you can.

What you get

• header / payload — fully decoded JSON
• claims — iss, sub, aud, plus ISO-formatted issuedAt / expiresAt / notBefore
• timestamps — each of iat/exp/nbf as {iso, unix, relative} ("in 3 days", "2 hours ago")
• expired — the bottom-line freshness verdict
• warnings — alg=none (forgeable), no exp claim, not-yet-valid, lifetime over a year, sensitive keys in the payload (password, api_key, ssn...), and always: signature not verified
• Fail-soft: a malformed token never fails the run — it returns {ok: false, error} and is never charged.

Input

{ "jwt": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U" }

Bulk: { "tokens": ["...", "..."] } (up to 50).

Output (real run, trimmed)

{
  "ok": true,
  "header": { "alg": "HS256", "typ": "JWT" },
  "claims": {
    "iss": "https://auth.example.com",
    "sub": "user-42",
    "aud": "api",
    "expiresAt": "2100-01-01T00:00:00.000Z",
    "issuedAt": "2018-01-18T01:30:22.000Z"
  },
  "expired": false,
  "signatureVerified": false,
  "warnings": [
    "Long-lived token: lifetime is ~29964 days (>1 year).",
    "Signature NOT verified: this tool decodes only, it does not validate the signature."
  ]
}

Example

A real run on 2026-10-31 with the input this page's form is prefilled with:

{
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}

It finished in 1 second and returned 1 result. It was charged for 1 jwt-decoded event ($0.002 on the Free plan). The first result (long text and lists cut for display):

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ...yJV_adQssw5c",
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": 1516239022
  },
  "claims": {
    "iss": null,
    "sub": "1234567890",
    "aud": null,
    "expiresAt": null,
    "issuedAt": "2018-01-18T01:30:22.000Z",
    "notBefore": null
  },
  "timestamps": {
    "iat": {
      "iso": "2018-01-18T01:30:22.000Z",
      "unix": 1516239022,
      "relative": "8 years ago"
    },
    "exp": null,
    "nbf": null
  },
  "alg": "HS256",
  "typ": "JWT",
  "expired": false,
  "signatureVerified": false,
  "warnings": [
    "No \"exp\" claim: token has no expiry and may be valid forever.",
    "Signature NOT verified: this tool decodes only, it does not validate the signature."
  ],
  "ok": true
}

Pricing

$0.002 per token decoded. No start fee. Malformed tokens are never charged.

Measured against the direct incumbent (2026-08-07): perryay/jwt-decoder-analyzer charges $0.02 per decode ($0.01 batch). One decode here is a tenth of that.

Honest limits

• Decode only — by design. Verifying a signature requires your secret or public key, which you should not hand to any third-party tool; verify with your own JWT library where the key already lives.
• JWS compact serialization only (three dot-separated parts). Encrypted JWE tokens (five parts) report as malformed.
• Warnings are hygiene checks, not a security audit — a token can pass every check here and still be stolen, replayed, or signed with a leaked key.

FAQ

Why would I decode without verifying? Debugging ("why is this request 401ing?" — usually an expired or wrong-audience token), inspecting third-party tokens whose keys you don't hold, auditing what your own auth server puts in payloads, and CI checks on token lifetimes.

Is it safe to paste a live token? The token is processed only inside your run and never sent to any external service; the output truncates the raw token. That said, a live token is a credential — the safest habit is decoding expired/staging tokens.

What does the alg=none warning mean? alg: none means the token declares itself unsigned — anyone can mint one. Any system accepting such tokens is trivially compromised; the warning exists because these still show up in the wild.

What sensitive claims are flagged? Keys like password, secret, api_key, private_key, access_token, ssn, credit_card, cvv, pin appearing in the payload — JWT payloads are readable by anyone who holds the token, so secrets do not belong there.

Why did some rows come back ok: false? Not a structurally valid JWT (wrong part count, broken base64url, non-JSON segments). Recorded with the exact reason, never charged.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~jwt-decoder/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"jwt": "<your-token>"}'

Agents: connect Apify MCP and call the EliAI/jwt-decoder tool.

• Capability: decode one or many JWTs — header, claims, expiry verdict, security warnings; NO signature verification, NO external transmission
• Required input: jwt/token (string) or tokens (array)
• Returns: one record per token; claims + expired + warnings summarize it
• Bounded: 50 tokens per run; failures isolate per token
• Side effects: none (pure local decode)

Who uses it

• Backend developers inspecting a token's claims and expiry while debugging auth errors
• Security reviewers flagging tokens with alg=none, no expiry or sensitive claims
• Support engineers checking whether a customer's token expired
• QA engineers asserting the claims an identity provider issues in test tokens
• API integrators reading the aud and iss a provider puts in its tokens

Changelog

• 2026-11-01: Page text only: an Example section from a real run. Code, output and price are unchanged.