{"uid":"cap_pCMQTonbmX235dayTtDOv","slug":"jwt-toolkit-decode-ef1d22eb","name":"JWT Toolkit – Decode","description":"Decode a JSON Web Token WITHOUT verifying its signature and return the header, payload and signature. A structurally malformed token is rejected before payment. Never trust a decoded payload you have not verified.","url":"https://jwt.openverbs.com/v1/decode","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["token"],"properties":{"token":{"type":"string","maxLength":32768,"minLength":1,"description":"The compact JWS/JWT string."}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_8x95F_0wi1HUIUbr4jKLH","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Decodes a compact JWS/JWT string and returns its header, payload, and signature components without verification","exampleAgentPrompt":"Can you decode this JWT for me and show me what's in it? eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c","exampleUseCases":[{"title":"Inspect expiring access token claims","prompt":"I have this access token and I want to know when it expires and what permissions it has — can you decode it for me? eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsInNjb3BlIjoicmVhZDp3cml0ZSIsImV4cCI6MTcxMDAwMDAwMH0.signature"},{"title":"Debug broken authentication flow","prompt":"My app is rejecting this JWT but I don't know what's wrong with it — can you parse it and tell me what's in the header and payload? eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo0Miwicm9sZSI6ImFkbWluIn0.abc123"},{"title":"Extract user identity from bearer token","prompt":"I received this bearer token from the OAuth server and need to know which user it belongs to and what their role is — please decode it: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhbGljZUBleGFtcGxlLmNvbSIsInJvbGUiOiJlZGl0b3IifQ.sig"}],"resultDescription":"Returns the decoded components of the JWT: the header (algorithm, token type), the payload (all claims such as sub, iat, exp, roles, custom data), and the raw signature section — without performing cryptographic signature verification.","failureModes":["Malformed JWT string (not three dot-separated base64url segments) returns a parse error","Empty or missing token field returns a validation error","Token exceeds 32768 character maximum length","Non-JWT string input (e.g. opaque token or API key) cannot be decoded","Network or payment authorization failure returns HTTP 402"],"whenToPreferThis":"Choose this endpoint when you need to quickly inspect the contents of a JWT/JWS token without needing cryptographic signature verification — useful for debugging, logging claims, extracting user identity, or reading expiration times. If you need to cryptographically verify the token signature against a public key or JWKS endpoint, this decode-only endpoint is not sufficient and you should look for a JWT verify endpoint instead.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:34:21.386Z","isFirstParty":false}