JWT Decoder

Decode a JWT without verifying it: header, payload, claims, and whether and when it expires.

Pay by wallet (x402) jwt-decode

Example

Example answer

{
  "claims": [
    "sub"
  ],
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "issuer": null,
  "payload": {
    "sub": "1234567890"
  },
  "subject": "1234567890",
  "audience": null,
  "algorithm": "HS256",
  "issued_at": null,
  "expires_at": null,
  "is_expired": null,
  "not_before": null,
  "token_type": "JWT",
  "time_until_expiry_seconds": null
}

Inputs

Field	Type	Required	What it is
`token`	string	Yes	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`header`	object	Always (present in every successful answer)
`payload`	object	Always (present in every successful answer)
`algorithm`	string	Always (present in every successful answer)
`expires_at`	string	Always (present in every successful answer)
`is_expired`	boolean	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "jwt-decode",
    "inputs": {
      "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
    },
    "max_price_cents": 2
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "jwt-decode",
    "inputs": {
      "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
    },
    "max_price_cents": 2
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "jwt-decode",
  inputs: {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
  },
  max_price_cents: 2,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="jwt-decode",
    inputs={
        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
    },
    max_price_cents=2,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/jwt-decode?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U'

Limitations

JWT signatures are not verified
Decodes JWT payload without signature verification — a decoded token is not proof of authenticity
What to do instead: Always verify JWT signatures using the issuer's public key or JWKS endpoint before trusting claims