{"uid":"cap_JCyEy8nnfP4WzGFsH2M_3","slug":"jwt-decode-security-flag-checker-94c9f949","name":"JWT Decode & Security Flag Checker","description":"Decode a JWT header and payload (no signature check) and flag alg none, expiry, nbf and missing claims.","url":"https://dev-utils.x402tookit.com/jwt-decode?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["token"],"properties":{"now":{"type":"string","description":"ISO time to judge exp/nbf against, default now"},"token":{"type":"string","description":"The JWT (three dot-separated parts). Use an expired or test token, never a live secret"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"alg":{"type":["null","string"]},"asOf":{"type":["null","string"]},"flags":{"type":["array","null"],"items":{"type":"object","properties":{"code":{"type":["null","string"]},"message":{"type":["null","string"]},"severity":{"type":["null","string"]}}}},"header":{"type":["null","object"],"properties":{"alg":{"type":["null","string"]},"typ":{"type":["null","string"]}}},"source":{"type":["null","string"]},"expired":{"type":["boolean","null"]},"payload":{"type":["null","object"],"properties":{"exp":{"type":["null","number"]},"iss":{"type":["null","string"]},"http://example.com/is_root":{"type":["boolean","null"]}}},"reasons":{"type":["array","null"],"items":{"type":"string"}},"summary":{"type":["null","string"]},"verdict":{"type":["null","string"]},"degraded":{"type":["boolean","null"]},"judgedAt":{"type":["null","string"]},"claimTimes":{"type":["null","object"],"properties":{"exp":{"type":["null","string"]}}},"disclaimer":{"type":["null","string"]},"notChecked":{"type":["array","null"],"items":{"type":"string"}},"notYetValid":{},"claimsMissing":{"type":["array","null"],"items":{"type":"string"}},"signatureBytes":{"type":["null","number"]},"secondsToExpiry":{"type":["null","number"]}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_JGULNI4etHYLdMtNwvg5w","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Decodes a JWT's header and payload without verifying the signature, and flags security issues like alg:none, expiry, not-before violations, and missing claims.","exampleAgentPrompt":"Can you decode this JWT for me and tell me if it's expired, uses a dangerous algorithm like alg:none, or is missing any important claims? The token is eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiaXNzIjoibXlhcHAiLCJleHAiOjE2MDAwMDAwMDB9.signature","exampleUseCases":[{"title":"Debugging expired auth token","prompt":"I have a JWT from our staging environment that seems to be failing — can you decode it and tell me if it's expired, and when exactly it expires? Token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwiZXhwIjoxNjAwMDAwMDAwfQ.sig"},{"title":"Security audit for alg:none vulnerability","prompt":"Can you inspect this JWT and flag any security problems — specifically whether it's using alg:none or another weak algorithm? Token: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiJ9."},{"title":"Check JWT validity at a past timestamp","prompt":"I want to verify whether this JWT would have been valid on 2024-01-15T12:00:00Z — decode it and check expiry and not-before against that specific time. Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyNDU2IiwiZXhwIjoxNzA1MzI0MDAwLCJuYmYiOjE3MDUyMzc2MDB9.sig"}],"resultDescription":"Returns the decoded JWT header and payload as JSON objects, the algorithm used, expiry status and seconds remaining, a judgedAt timestamp, a verdict string, a human-readable summary, an array of security flags (each with code, severity, and message), lists of missing or unchecked claims, and a disclaimer noting that the signature is not verified.","failureModes":["Malformed JWT (not three dot-separated parts) returns an error","Token with non-base64url encoding fails to decode","Invalid ISO timestamp in 'now' parameter causes a parse error","Empty or missing token query parameter returns a 400-style error"],"whenToPreferThis":"Use this endpoint when you need to quickly inspect a JWT's contents and catch common security misconfigurations (alg:none, expiry, nbf, missing claims) without having access to the signing secret or public key. It is ideal for debugging, auditing, or pipeline validation steps where signature verification is handled separately or is not required.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-02T12:30:33.558Z","isFirstParty":false,"canonicalSlug":"jwt-decode-security-flag-checker-94c9f949"}