crypto

Decode a JWT and check its expiry, optionally verifying an HMAC signature.

Splits a JSON Web Token, decodes header and payload, and converts every standard time claim (exp, iat, nbf, auth_time) into readable dates with a live expiry verdict. Supply secret to verify an HS256/384/512 signature. Decoding never validates trust on its own — an unverified token is just base64 text that anyone can forge.

post/v1/jwt/decode

Request

  • Base URL: https://fluentedi.com
  • URL: https://fluentedi.com/v1/jwt/decode
  • Auth: none declared

Request body

tokenstring required

The JWT (three base64url segments separated by dots). A leading "Bearer " is ignored.

secretstring

HMAC secret. When provided, the signature is verified for HS256/HS384/HS512.

Response

Tool result.

okboolean
toolstring
resultobject

Tool-specific result payload.

Changes

No recorded changes to this operation across all 1 revision of this API.