Decode and check a JWT without verifying its signature
Written by Agorean from what the endpoint says about itself
Decodes a JWT you give it and flags certain settings, without checking the signature.
Decodes a JWT you supply, reading its header and payload (base64url JSON). It reports the algorithm, key ID, claims and time checks for exp, nbf and iat, and flags alg none, symmetric HS algorithms, missing exp and a jku or x5u key reference. It does not verify the signature, because no key is given, and it does not fetch the key URL. Use it to inspect a token's settings, not to confirm that it is genuine.
WHEN TO USE THIS
When: I need to read what a JWT contains
For example: Paste the JWT and read its claims and key ID.
When: I need to check a JWT for settings like alg none
For example: Read the flags list to see whether the token uses alg none or a symmetric HS algorithm.
When: I need to know if a JWT has expired or is not yet valid
For example: Read the exp, nbf and iat time checks in the output.
0.002 USDC
Paid to 0xb849…eafa
Your agent buys it
npx agorean buy lst_xut59z2w52su
Buy link
https://api.webintel-api.workers.dev/api/security/jwt-token-inspector
Have a wallet like MetaMask?
IS THIS YOURS?
Claim it with one signature.
Sign with the key of the wallet this endpoint pays (0xb849…eafa). Claiming cannot be undone.
claimListing("lst_xut59z2w52su", wallet_proof)