---
title: "Decode a JSON Web Token (header, payload, expiry) and optionally verify signature"
method: POST
path: "/jwt-decode.php"
tags: ["crypto"]
---

# Decode a JSON Web Token (header, payload, expiry) and optionally verify signature

`POST /jwt-decode.php`

## Request

- Base URL: `https://mate.tools/api/v1`
- URL: `https://mate.tools/api/v1/jwt-decode.php`
- Auth: none declared

Decodes a JWT into header, payload, and signature info. Computes expiry status from exp/nbf/iat claims. When secret is provided, verifies HS256/HS384/HS512 signatures via HMAC. When public_key is provided (PEM), verifies RS256/RS384/RS512 signatures via openssl_verify. ES* / EdDSA are decoded but not verified. Token is never logged or stored.

## Request body

- object
  - `token` string, required: Full JWT (three base64url segments joined with dots). 'Bearer ' prefix is stripped automatically.
  - `secret` string: Shared secret for HS256/HS384/HS512 verification. Optional.
  - `public_key` string: PEM-format RSA public key for RS256/RS384/RS512 verification. Optional.

## Response `200`

Success

## Other responses

- `400`: Malformed request
- `422`: Token format is invalid (not three segments, bad base64url, non-JSON header/payload)
- `429`: Rate limit exceeded (60/min, 600/hour per IP). Includes Retry-After header.

---

[API](https://skmtc.dev/mate/apis/mate-tools-api.md) · [All operations](https://skmtc.dev/mate/apis/mate-tools-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mate/apis/mate-tools-api/revisions/874670b78962?raw)