{"uid":"cap_b-oHYG_QrLSV9osgCgVfe","slug":"sitecheck-web-intel-jwt-token-inspector-63204513","name":"SiteCheck Web Intel JWT Token Inspector","description":"Decodes a JWT you supply (header and payload, base64url JSON) and reports its algorithm, key id, claims, and time checks (exp, nbf, iat). Flags alg none, symmetric HS algorithms, missing exp and a jku/x5u key reference. It does not verify the signature, because no key is given, and it does not fetch the key URL.","url":"https://api.webintel-api.workers.dev/api/security/jwt-token-inspector?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["token"],"properties":{"token":{"type":"string","description":"A JWT in compact form: header.payload.signature (required, max 8 KB)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_g6n3rgEO5wlEktRik7G8k","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Decodes a JWT (header and payload) and reports its algorithm, key ID, claims, and time checks, flagging common security issues without verifying the signature","exampleAgentPrompt":"Can you decode this JWT for me and flag any security issues like alg:none, missing expiration, or symmetric algorithms? Here's the token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c","exampleUseCases":[{"title":"Security audit of issued token","prompt":"I found this JWT in our app logs and want to know what algorithm it uses, what claims are in it, and whether it has an expiration set — can you inspect it and flag any red flags? Token: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ1c2VyMTIzIiwiYWRtaW4iOnRydWV9."},{"title":"Checking token expiry before use","prompt":"Can you decode this JWT and tell me if it's expired or not yet valid based on the exp and nbf fields? eyJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyJ9.eyJzdWIiOiJ1c2VyNDU2IiwiZXhwIjoxNjAwMDAwMDAwLCJuYmYiOjE1OTAwMDAwMDB9.signature"},{"title":"Identifying dangerous JWT algorithm","prompt":"Please inspect this token and let me know if it's using a weak or dangerous algorithm like HS256 or alg:none, and whether there's a jku or x5u key reference I should be worried about: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.xyz"}],"resultDescription":"Returns decoded JWT header fields (algorithm, type, key ID), payload claims (sub, iss, aud, exp, nbf, iat, and custom claims), time validity checks (expired, not-yet-valid, issued-at), and security flags for issues such as alg:none, symmetric HS algorithms, missing expiration, and presence of jku/x5u key URL references. Does not verify the signature.","failureModes":["Malformed or non-base64url token returns a parse error","Token exceeding 8 KB limit is rejected","Missing 'token' query parameter returns a validation error","Tokens with encrypted payloads (JWE) cannot be decoded","Network or worker availability issues may cause 5xx errors"],"whenToPreferThis":"Use this endpoint when you need to quickly decode and audit a JWT without access to the signing key — ideal for security reviews, debugging, or automated token scanning pipelines. Prefer this over full JWT verification libraries when you only need structural inspection, claim extraction, and common vulnerability flagging (alg:none, missing exp, weak algorithms) and don't need cryptographic signature validation.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:45:25.402Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-jwt-token-inspector-63204513"}