Decode a JWT, see when it expires in plain words and catch alg none and sensitive claims.

JWT decoderFreeFor developers

3 min

saved on a typical run. Our estimate, against base64url-decoding the header and payload separately and converting the timestamps by hand.

Before: what you give it

The example input, as typed in. You paste text or a file's contents.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ii4uLy4uL2tleXMvZGV2LnBlbSJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzEwNDIiLCJhdWQiOiJhcGkuZXhhbXBsZS5jb20iLCJpYXQiOjE3MTcyMDAwMDAsImV4cCI6MTcxNzIwMzYwMCwicm9sZSI6ImFkbWluIiwicGFzc3dvcmQiOiJodW50ZXIyIn0.bm90LWEtcmVhbC1zaWduYXR1cmU

After: what comes back

The first lines of a real run of the tool's own code on that input. Nothing here is edited by hand.

alg HS256  kid ../../keys/dev.pem  signature present, not verified
iss https://auth.example.com  sub user_1042  aud api.example.com
iat 2024-06-01T00:00:00.000Z
nbf -
exp 2024-06-01T01:00:00.000Z  (expired 2 years ago)

Header:
{
  "alg": "HS256",
  "typ": "JWT",
  "kid": "../../keys/dev.pem"
}

Payload:
{
  "iss": "https://auth.example.com",
... full output on the tool page

What you get

Header, payload, timestamps in plain dates, expiry in words, and findings on risky settings

What it cannot do

Decodes only: it never verifies a signature, so a clean result says nothing about whether the token is genuine.

Who it is for

Developers

Free and Pro

Free	30 runs a day per IP address.
Pro	No daily limit, 300 requests a minute.

Daily caps for every tool

Use it from your assistant

The tool is called decode_jwt. Connect the server once, then ask for it by name or describe the job. Install steps.

claude mcp add --transport http toolbox https://toolbox.allthepossibles.com/mcp

curl -X POST https://toolbox.allthepossibles.com/api/jwt -H 'content-type: application/json' -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ii4uLy4uL2tleXMvZGV2LnBlbSJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzEwNDIiLCJhdWQiOiJhcGkuZXhhbXBsZS5jb20iLCJpYXQiOjE3MTcyMDAwMDAsImV4cCI6MTcxNzIwMzYwMCwicm9sZSI6ImFkbWluIiwicGFzc3dvcmQiOiJodW50ZXIyIn0.bm90LWEtcmVhbC1zaWduYXR1cmU"}'

Try it here

The form starts with the same example input, so you can run it first and then swap in your own.

JWT