Decode a JWT (no signature check)
Exactencoding_jwt_decodeDeterministic and authoritative — the canonical answer for this input.
Decode a JWT's header and claims WITHOUT verifying the signature — for inspection only, never for an access decision. Pass reference_time (an epoch or ISO 8601 instant) to also evaluate is_expired against the exp claim. Processing multiple inputs? Use `encoding_jwt_decode_batch` to do up to 1000 in one call.
Parameters
valuestringrequiredThe JWT to decode (signature is NOT verified).
reference_timestringoptionalOptional epoch or ISO 8601 instant to evaluate is_expired against.
Call it
curl -X POST https://api.snipget.ai/v1/encoding/jwt/decode \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{"value":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIFNtaXRoIiwicm9sZSI6ImFkbWluIiwiZXhwIjoxODkzNDU2MDAwfQ.BBSt9rgwaE0TR-2dWSJD7JxIfci75LgsZfoS8LPeiao"}'The Batch tab sends up to 1000 inputs in one call via /v1/encoding/jwt/decode/batch.
Example response
{
"input": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIFNtaXRoIiwicm9sZSI6ImFkbWluIiwiZXhwIjoxODkzNDU2MDAwfQ.BBSt9rgwaE0TR-2dWSJD7JxIfci75LgsZfoS8LPeiao",
"is_valid": true,
"header": {
"alg": "HS256",
"typ": "JWT"
},
"claims": {
"sub": "1234567890",
"name": "Alice Smith",
"role": "admin",
"exp": 1893456000
},
"algorithm": "HS256",
"type": "JWT",
"expires_at": "2030-01-01T00:00:00+00:00"
}FAQ
What does this tell me?
It opens up a JWT (the long token apps use to identify a signed-in user) and shows you what's inside: the header, the claims like who the user is and what role they have, the algorithm, and when it expires. It's the easy way to read a token while debugging.
Does it check whether the token is genuine?
No, and this is the important boundary: it does NOT verify the signature. It only reads what the token says, so never use it to decide whether to grant access. Treat the contents as 'what the token claims', not 'what's proven true'.
How do I find out if a token is expired?
Pass a reference_time (a date or a Unix timestamp) along with the token. The result then includes is_expired, comparing your time against the token's exp claim. Without it, the tool never reads the clock, so the answer stays the same every run.
What if I paste in something that isn't a real token?
You get a clean result with is_valid set to false, confidence 0, and a why_invalid reason, rather than an error. Empty input and malformed tokens are both handled this way.
Is the decoded output exact?
Yes. Reading the token's contents is an exact, deterministic operation, so the decoded header and claims are authoritative for that token.