Jwt Decode

Quick way to peek inside a JWT without spinning up a debugger or hitting jwt.io. Paste in a token and you get the header, payload, and all claims formatted cleanly, with exp/iat timestamps converted to human-readable dates. It'll yell at you if it spots alg:none (the classic bypass attack), tokens with no expiry, or sensitive data sitting in plain view. This is decode only, no signature verification, so it's for inspection and debugging, not trust decisions. If you need to actually verify a token's signature, you want jwt-validate instead.

skills.sh installs: 743
GitHub stars: 20
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add jsonwebtoken/jwt-skills --skill jwt-decode --agent claude-code

Installs into .claude/skills of the current project.

Files

JWT Decode

Decode a JWT by base64url-decoding its header and payload. Does NOT verify signatures — use jwt-validate for that.

Steps

Split the token on . into three parts (header, payload, signature).
Base64url-decode and parse parts 1 and 2 as JSON.
Display header, payload (with all claims), and the raw signature string.
For exp, nbf, iat — show both the Unix timestamp and human-readable UTC. If exp is past, note expired and by how long.
Run security checks (see below).

Output Format

## Header
{ "alg": "RS256", "typ": "JWT", "kid": "abc123" }

## Payload
{ "iss": "https://auth.example.com/", "sub": "user|12345", "exp": 1735689600 }

exp: 2025-01-01T00:00:00Z — EXPIRED (3 months ago)
iat: 2024-12-31T00:00:00Z

## Signature
Algorithm: RS256 | Signature: [base64url string]
(Not verified — use jwt-validate to verify)