crypto

Decode a JSON Web Token (header, payload, expiry) and optionally verify signature

Decodes a JWT into header, payload, and signature info. Computes expiry status from exp/nbf/iat claims. When secret is provided, verifies HS256/HS384/HS512 signatures via HMAC. When public_key is provided (PEM), verifies RS256/RS384/RS512 signatures via openssl_verify. ES* / EdDSA are decoded but not verified. Token is never logged or stored.

post/jwt-decode.php

Request

  • Base URL: https://mate.tools/api/v1
  • URL: https://mate.tools/api/v1/jwt-decode.php
  • Auth: none declared

Request body

tokenstring required

Full JWT (three base64url segments joined with dots). 'Bearer ' prefix is stripped automatically.

secretstring

Shared secret for HS256/HS384/HS512 verification. Optional.

public_keystring

PEM-format RSA public key for RS256/RS384/RS512 verification. Optional.

Response

Success

Changes

No recorded changes to this operation across all 1 revision of this API.