Decode a JWT without verifying its signature

GEThttps://api.testingapis.com/api/utils/jwt/decodeSign in to see this endpoint's URL

Returns the header, the payload and readable exp/iat/nbf claims with an expiry flag. The signature is never verified, so never trust the claims.

Parameters 1

Name	Type	Description
`token`	query · string	The JWT. If omitted, the Bearer token from the Authorization header is used.

Responses

200: Success.
400: No token, wrong number of parts, or a part is not base64url-encoded JSON.

Example

Request

curl -X GET "https://api.testingapis.com/api/utils/jwt/decode?token={{userJwt}}" \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{
  "header": {"alg": "HS256", "typ": "JWT"},
  "payload": {
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "user",
    "http://schemas.microsoft.com/ws/2008/06/identity/claims/role": "user",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "user@example.com",
    "jti": "483a95f9-27f2-4fac-8cad-5fbfb00d0864",
    "nbf": 1790792795,
    "exp": 1790793695,
    "iss": "https://api.testingapis.com",
    "aud": "https://api.testingapis.com"
  },
  "signature": "eproOvW-6EYJzoQ8Z6TYiCu90Id1yK-n_tJlKeYKpLY",
  "verified": false,
… (8 more lines)

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl 'https://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D' \
  -H 'X-TestingApis-Key: YOUR_API_KEY'

const res = await fetch("https://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D", {
  headers: {
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
console.log(res.status, await res.text());

const res = await fetch("https://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D", {
  headers: {
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
const body: string = await res.text();
console.log(res.status, body);

import requests

res = requests.get(
    "https://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D",
    headers={
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
)
print(res.status_code, res.text)

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D"))
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .GET()
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

User JWT{{userJwt}}

POST /api/auth/jwt/login as user / user123.

GEThttps://api.testingapis.com/api/utils/jwt/decode?token=%7B%7BuserJwt%7D%7D

Query

tokenstring