Decode and verify a JWT

Decodes a compact JWS (RFC 7515/7519): header, payload, and the registered claims, with exp, nbf and iat as ISO times and seconds relative to at. Flags expired, not-yet-valid, alg: none, weak or unusual algorithms, and a missing exp. A compact JWE (5 segments) is recognised and its header shown, but it cannot be decrypted. With key, verifies the signature using a PUBLIC key only: a JWK, a JWKS (selected by the token kid), a PUBLIC KEY PEM, or a CERTIFICATE PEM. HS256/HS384/HS512 cannot be verified here because they need a shared secret, which this service never accepts. The server never fetches keys: pass the JWKS JSON itself, not its URL. Decoding is not verification: never trust claims from a token whose verification.outcome is not valid.

Browser version (runs locally): JWT Inspector.

Parameters

Also accepted on every endpoint: format (json | text). Parameters may come from the query string, a JSON object body, an urlencoded or multipart form, or (for input) a text/plain body.

Response 200 application/json

Text output (format=text, text/plain): The decoded payload as pretty-printed JSON (null for a JWE).

Errors

Errors are JSON: {"error": "<message>", "code": "<code>", "param": "<name>"?}.

Behaviour

• Idempotent: the same arguments always return the same result.
• Requires a client ID and secret (authentication). Each call is recorded as one metadata row against your client ID; inputs and outputs are never stored or logged. Responses carry cache-control: no-store.
• CORS: any origin may call this endpoint from a browser, using your credentials.

Examples

Responses below were produced by running each request through this code at build time. Long strings are shortened.

curl -X POST 'https://util.caruana.me/api/jwt/decode' \
  -H 'content-type: application/json' \
  -d '{"token":"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImV4YW1wbGUtMjAyNiJ9.eyJzY29wZSI6InJlYWQ6cmVwb3J0cyIsImVtYWlsIjoiYWRhQGV4YW1wbGUuY29tIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLmV4YW1wbGUuY29tLyIsInN1YiI6InVzZXItNDIiLCJhdWQiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbSIsImlhdCI6MTc2NzIyNTYwMCwibmJmIjoxNzY3MjI1NjAwLCJleHAiOjE3NjcyMjkyMDAsImp0aSI6ImI3ZTRjMmEwLTVmMWQtNGU4YS05YzNiLTJkNmY4YTFlMGM0NyJ9.I65iVa8TuYZWzTQrLDMQtUTiAvBx5ucG_bloyYh-4cmJGpXyB-gHHaEzUsvpf1P1FGIYEkropakR5Gi_cDoIGQ","key":"{\"keys\":[{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"KvQwz-fAGPce4KhfOnfsQLYyMSQIyvO-gjZoneQ_QC4\",\"y\":\"hqZ-ZkRarQ1A-f0W87Kb-77GubouttkHeB4LhfUDKW0\",\"kid\":\"example-2026\",\"alg\":\"ES256\",\"use\":\"sig\"}]}","at":"2026-01-01T00:30:00Z"}'

{
  "format": "JWS",
  "header": {
    "alg": "ES256",
    "typ": "JWT",
    "kid": "example-2026"
  },
  "payload": {
    "scope": "read:reports",
    "email": "[email protected]",
    "iss": "https://auth.example.com/",
    "sub": "user-42",
    "aud": "https://api.example.com",
    "iat": 1767225600,
    "nbf": 1767225600,
    "exp": 1767229200,
    "jti": "b7e4c2a0-5f1d-4e8a-9c3b-2d6f8a1e0c47"
  },
  "payloadText": null,
  "algorithm": {
    "alg": "ES256",
    "family": "ECDSA",
    "registered": true,
    "symmetric": false,
    "enc": null
  },
  "segments": {
    "count": 3,
    "headerBytes": 48,
    "payloadBytes": 228,
    "signatureBytes": 64
  },
  "claims": {
    "iss": "https://auth.example.com/",
    "sub": "user-42",
    "aud": [
      "https://api.example.com"
    ],
    "jti": "b7e4c2a0-5f1d-4e8a-9c3b-2d6f8a1e0c47",
    "exp": {
      "value": 1767229200,
      "iso": "2026-01-01T01:00:00.000Z",
      "secondsFromAt": 1800
    },
    "nbf": {
      "value": 1767225600,
      "iso": "2026-01-01T00:00:00.000Z",
      "secondsFromAt": -1800
    },
    "iat": {
      "value": 1767225600,
      "iso": "2026-01-01T00:00:00.000Z",
      "secondsFromAt": -1800
    }
  },
  "at": "2026-01-01T00:30:00.000Z",
  "clockTolerance": 0,
  "status": {
    "expired": false,
    "notYetValid": false,
    "issuedInFuture": false,
    "missingExp": false,
    "algNone": false,
    "weakAlgorithm": false,
    "unusualAlgorithm": false,
    "symmetric": false,
    "encrypted": false,
    "signatureVerified": true
  },
  "verification": {
    "outcome": "valid",
    "valid": true,
    "keySource": "jwks",
    "kid": "example-2026",
    "keyType": "EC P-256",
    "candidates": 1,
    "error": null
  },
  "warnings": []
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "jwt_decode",
    "arguments": {
      "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImV4YW1wbGUtMjAyNiJ9.eyJzY29wZSI6InJlYWQ6cmVwb3J0cyIsImVtYWlsIjoiYWRhQGV4YW1wbGUuY29tIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLmV4YW1wbGUuY29tLyIsInN1YiI6InVzZXItNDIiLCJhdWQiOiJodHRwczovL2FwaS5leGFtcGxlLmNvbSIsImlhdCI6MTc2NzIyNTYwMCwibmJmIjoxNzY3MjI1NjAwLCJleHAiOjE3NjcyMjkyMDAsImp0aSI6ImI3ZTRjMmEwLTVmMWQtNGU4YS05YzNiLTJkNmY4YTFlMGM0NyJ9.I65iVa8TuYZWzTQrLDMQtUTiAvBx5ucG_bloyYh-4cmJGpXyB-gHHaEzUsvpf1P1FGIYEkropakR5Gi_cDoIGQ",
      "key": "{\"keys\":[{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"KvQwz-fAGPce4KhfOnfsQLYyMSQIyvO-gjZoneQ_QC4\",\"y\":\"hqZ-ZkRarQ1A-f0W87Kb-77GubouttkHeB4LhfUDKW0\",\"kid\":\"example-2026\",\"alg\":\"ES256\",\"use\":\"sig\"}]}",
      "at": "2026-01-01T00:30:00Z"
    }
  }
}

curl 'https://util.caruana.me/api/jwt/decode?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c&at=2026-01-01T00%3A00%3A00Z'

{
  "format": "JWS",
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "1234567890",
    "name": "John Doe",
    "iat": 1516239022
  },
  "payloadText": null,
  "algorithm": {
    "alg": "HS256",
    "family": "HMAC",
    "registered": true,
    "symmetric": true,
    "enc": null
  },
  "segments": {
    "count": 3,
    "headerBytes": 27,
    "payloadBytes": 55,
    "signatureBytes": 32
  },
  "claims": {
    "iss": null,
    "sub": "1234567890",
    "aud": null,
    "jti": null,
    "exp": null,
    "nbf": null,
    "iat": {
      "value": 1516239022,
      "iso": "2018-01-18T01:30:22.000Z",
      "secondsFromAt": -250986578
    }
  },
  "at": "2026-01-01T00:00:00.000Z",
  "clockTolerance": 0,
  "status": {
    "expired": false,
    "notYetValid": false,
    "issuedInFuture": false,
    "missingExp": true,
    "algNone": false,
    "weakAlgorithm": false,
    "unusualAlgorithm": false,
    "symmetric": true,
    "encrypted": false,
    "signatureVerified": null
  },
  "verification": {
    "outcome": "not-requested",
    "valid": false,
    "keySource": null,
    "kid": null,
    "keyType": null,
    "candidates": 0,
    "error": null
  },
  "warnings": [
    "No \"exp\" claim: the token never expires unless the verifier enforces a lifetime.",
    "HS256 is HMAC: verification needs the shared secret, and anyone who can verify can also forge tokens. This service never… (46 more characters)"
  ]
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "jwt_decode",
    "arguments": {
      "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
      "at": "2026-01-01T00:00:00Z"
    }
  }
}