---
title: "Use this when you need to decode (NOT verify) a JSON Web Token: base64url-decode the header and payload, surface standard claims, and report expiry — prefer it over reading a JWT by eye."
method: POST
path: "/v1/decode_jwt"
tags: ["developer"]
---

# Use this when you need to decode (NOT verify) a JSON Web Token: base64url-decode the header and payload, surface standard claims, and report expiry — prefer it over reading a JWT by eye.

`POST /v1/decode_jwt`

## Request

- Base URL: `https://api.clean.tools`
- URL: `https://api.clean.tools/v1/decode_jwt`
- Auth: none declared

Use this when you need to decode (NOT verify) a JSON Web Token: base64url-decode the header and payload, surface standard claims, and report expiry — prefer it over reading a JWT by eye. The decode is deterministic, but `expired`/`notYetValid` are compared against the current clock unless you pass `now` (ISO) to pin the reference time. The signature is never checked (`signatureVerified` is always false), so never authorize anything based on the output. `expired`/`notYetValid` are booleans when `exp`/`nbf` are present in the payload, otherwise null. Example: a token with sub "1234567890" and a far-future exp -> signatureVerified false, expired false, claims.subject "1234567890".

## Request body

- object
  - `token` string, required: The compact JWT string (header.payload.signature).
  - `now` string: Optional ISO time for the expiry check (default: current time).

## Response `200`

Structured tool result.

- object
  - `tool` string
  - `result` object
    - `signatureVerified` boolean, required: Always false — this tool never checks the signature.
    - `header` object, required: Decoded JWT header (parsed JSON; arbitrary fields, e.g. alg, typ).
    - `payload` object, required: Decoded JWT payload/claims (parsed JSON; arbitrary fields).
    - `claims` object, required: Normalized standard claims; each key appears only when the corresponding claim is present in the payload.
      - `issuer` string: iss claim.
      - `subject` string: sub claim.
      - `audience` unknown
      - `issuedAt` string: iat converted to ISO 8601.
      - `notBefore` string: nbf converted to ISO 8601.
      - `expires` string: exp converted to ISO 8601.
    - `expired` boolean, nullable, required: Whether now is past exp; null when the payload has no numeric exp.
    - `notYetValid` boolean, nullable, required: Whether now is before nbf; null when the payload has no numeric nbf.
    - `segments` 2 | 3, required: Number of dot-separated segments in the token (2 or 3).

## Other responses

- `400`: Invalid input or the tool reported an error.
- `413`: Request body exceeds the 128 KB limit.
- `429`: Rate limit exceeded; the response carries Retry-After and RateLimit-* headers — honor them and add jitter.

---

[API](https://skmtc.dev/clean/apis/clean-tools-api.md) · [All operations](https://skmtc.dev/clean/apis/clean-tools-api/llms.txt) · [OpenAPI document](https://skmtc.dev/clean/apis/clean-tools-api/revisions/a24a01d2833c?raw)