JWT decoder API: read header, payload and expiry without a key

$0.01 per call · failed calls are never charged · no account or subscription: pay per call with a card key or USDC

JWT decode without a key: the header and payload of a JSON Web Token (the signature is not verified), with issued-at, not-before and expiry as dates and whether it has expired. The token is not stored. Do not use the result to trust a token. Use to debug auth flows.

When to use it

Run it free (25 free calls) Buy credits by card (from $1) Example result (JSON)

Try it with your own inputs

The JWT

Uses one of your 25 free calls. Nothing is charged, and a call that fails is not counted.

Inputs

NameTypeDescription
token (required)stringThe JWT

Request

Over HTTP, with a card key from /credits:

curl -H "Authorization: Bearer adt_…" "https://tools.funwords.eu/jwt/decode?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3OTIyODE2MDB9.sig"

Or one of your 25 free calls, no key:

curl "https://tools.funwords.eu/jwt/decode?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3OTIyODE2MDB9.sig&trial=1"

Without a key, the same URL answers 402 Payment Required with x402 and MPP terms, so an agent with a wallet pays per call in USDC (Base, Polygon, Arbitrum or Solana over x402; Base or Tempo over MPP) and retries.

Example result

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "sub": "123",
    "exp": 1792281600
  },
  "expiresAt": "2026-10-18T00:00:00.000Z",
  "expired": true,
  "signatureVerified": false
}

From an AI agent (MCP)

Add the MCP server to Claude, Cursor or any MCP client. This tool is jwt_decode, and the first 25 successful calls are free:

https://tools.funwords.eu/mcp

Questions

Does it verify the signature?

No. signatureVerified is always false; do not use the result to trust a token.

Is the token stored?

No.

How do I pay?

Each successful call costs $0.01; failed calls are not charged. The first 25 calls are free. Then pay with card credits (from $1; the key goes in an Authorization header or, for clients that can only fetch a URL, as api_key= in the URL) or per call in USDC over x402 or MPP. No account is needed.

Related tools