{"uid":"cap_AO8Scq-_OQNB0KqTETia2","slug":"jwt-decode-no-signature-verification-1147c2dd","name":"JWT Decode (No Signature Verification)","description":"JWT decoder (no signature verification, nothing stored): header (alg, kid, typ), payload claims, human-readable iat/exp/nbf, whether the token is expired or not yet valid, seconds until expiry, and warnings such as alg=none, missing exp, or very long lifetime. $0.01 per token.","url":"https://intel.rallylive.ca/dev/jwt-decode","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_11ZvhkYCeNIBl3IPDVj48","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Decodes a JWT token's header and payload claims, checks expiry status, and flags security warnings — without verifying the signature or storing the token.","exampleAgentPrompt":"Can you decode this JWT for me and tell me what claims are in it, whether it's expired, and if there are any security warnings like alg=none or missing exp? Here's the token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c","exampleUseCases":[{"title":"Debug expired auth token","prompt":"I've got a JWT token from our API that seems to be rejected — can you decode it and tell me if it's expired, when it was issued, and when it expires? Token: eyJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQ1NiIsImV4cCI6MTY5MDAwMDAwMCwiaWF0IjoxNjg5OTk2NDAwfQ.signature"},{"title":"Security audit for alg=none vulnerability","prompt":"Check this JWT token for security issues — specifically whether it's using alg=none, has a missing exp claim, or has an unusually long lifetime. Here's the token: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJzdXBlcnVzZXIifQ."},{"title":"Inspect third-party token claims","prompt":"I received this JWT from a third-party OAuth provider and want to see all the payload claims, the algorithm used, and how many seconds until it expires — can you decode it without verifying the signature? Token: eyJhbGciOiJFUzI1NiIsImtpZCI6InByb2Qta2V5LTEiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzc4OSIsImV4cCI6MTcwMDAwMDAwMCwibmJmIjoxNjk5OTk2NDAwLCJpYXQiOjE2OTk5OTY0MDB9.signature"}],"resultDescription":"Returns the decoded JWT header (alg, kid, typ), full payload claims, human-readable timestamps for iat/exp/nbf, a boolean indicating whether the token is currently expired or not yet valid, seconds remaining until expiry, and an array of security warnings (e.g. alg=none detected, missing exp claim, excessively long token lifetime).","failureModes":["Malformed or non-JWT string input returns an error — token must be a valid base64url-encoded JWT structure","Token with no exp claim returns a warning rather than expiry time","Very long or truncated tokens may fail parsing","Network or service unavailability returns a non-200 response"],"whenToPreferThis":"Choose this endpoint when you need to quickly inspect the contents and health of a JWT token without performing cryptographic signature verification — ideal for debugging, auditing, or extracting claims in a trusted internal context. It's purpose-built for JWT analysis (including security warning detection) rather than a generic base64 decoder, and it provides human-readable timestamps and expiry calculations out of the box.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T13:05:20.422Z","isFirstParty":false}