{"uid":"cap_sLIyrlkLPkYaHr9MYFhtF","slug":"jwt-decoder-with-safety-flags-5b0d793a","name":"JWT Decoder with Safety Flags","description":"Paid micro-utilities for cold-email outreach agents: domain deliverability audits, cold-email grading, template generation, plus a tools toolbox (hashing, JWT decode, IDs, slugs, JSON, regex, crypto prices, domain age, weather). Paid via x402 (USDC on Base). One signature per call. No keys. FREE CHECK: GET /preview/<paid-path> (same URL with /preview/ prefix) returns a 200 demo sample - verify output shape before paying. PAID CALL: GET the url -> 402 challenge -> sign + retry with X-PAYMENT -> settled on-chain (USDC, Base). Ready-to-paste client: GET /llms.txt section \"Pay in one call\". Catalog+MCP twin: /llms.txt.","url":"https://sigtap-outreach-api.sigtap.workers.dev/tools/jwt-decode","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"flags":{"expired":true,"alg_none":false,"weak_alg":false,"exp_missing":false},"header":{"alg":"HS256","typ":"JWT"},"payload":{"exp":1735689600,"sub":"1"},"signature":{"present":true}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_MFgEk6bOBgzCCbHs9Yb-i","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Decodes a JWT token's header and payload and returns safety flags (expired, alg:none, weak algorithm, missing exp) without verifying the signature","exampleAgentPrompt":"Can you decode this JWT for me and check if it's expired or using a weak algorithm — eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwiZXhwIjoxNzM1Njg5NjAwfQ.signature — just the header and payload, no signature verification needed.","exampleUseCases":[{"title":"Debugging expired auth token","prompt":"I've got this JWT token from our staging API and the service keeps rejecting it — can you decode it and tell me if it's expired or what the payload actually contains? Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3MDA2MDAwMDB9.sig"},{"title":"Security audit for weak JWT algorithm","prompt":"We're auditing our authentication flow and need to check whether any of our tokens are using alg:none or a weak signing algorithm — can you decode this JWT and flag any security issues: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ1c2VyMSJ9."},{"title":"Inspecting third-party token claims","prompt":"I received a JWT from a third-party OAuth provider and I want to see what claims are in the payload — like the subject, expiration, and any custom fields — without verifying the signature. Here's the token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyQGV4YW1wbGUuY29tIiwiZXhwIjoxODAwMDAwMDAwfQ.sig"}],"resultDescription":"Returns a JSON object containing the decoded JWT header (e.g. alg, typ), decoded payload (all claims including sub, exp, iat, etc.), signature presence flag, and a flags object with boolean safety indicators: expired (whether exp is in the past), alg_none (whether algorithm is 'none'), weak_alg (whether a weak algorithm like HS256 is used), and exp_missing (whether expiration claim is absent).","failureModes":["Malformed or non-base64 JWT string returns an error","Missing token query parameter returns validation error","JWT with missing segments (not 3 dot-separated parts) fails to parse","Network timeout on the Cloudflare Worker edge"],"whenToPreferThis":"Choose this endpoint when you need to quickly inspect JWT contents and check for common security misconfigurations (expired tokens, alg:none, weak algorithms, missing expiration) without needing signature verification. Ideal for debugging, auditing, or logging token metadata in pipelines where you don't have or need the signing secret. Prefer this over manual base64 decoding when you also want structured safety flags automatically computed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:31:37.814Z","isFirstParty":false}