Decode a JWT header and payload (no signature check) and flag alg none, expiry, ...

{ "method": "GET", "queryParams": { "token": "eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }, "type": "http" }

{ "example": { "alg": "HS256", "asOf": "2026-10-21T15:48:32.701Z", "claimTimes": { "exp": "2011-03-22T18:43:00.000Z" }, "claimsMissing": [ "sub", "aud", "…1 more" ], "degraded": false, "disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.", "expired": true, "flags": [ { "code": "EXPIRED", "message": "exp 2011-03-22T18:43:00.000Z is in the past (491778332 seconds ago).", "severity": "HIGH" }, { "code": "CLAIMS_MISSING", "message": "Missing common claims: sub, aud, iat.", "severity": "LOW" } ], "header": { "alg": "HS256", "typ": "JWT" }, "judgedAt": "2026-10-21T15:48:32.000Z", "notChecked": [ "the signature (this decodes only: a decoded token is NOT proof it is genuine)", "whether the issuer, audience or key are the ones you expect", "…1 more" ], "notYetValid": null, "payload": { "exp": 1300819380, "http://example.com/is_root": true, "iss": "joe" }, "reasons": [ "HIGH: exp 2011-03-22T18:43:00.000Z is in the past (491778332 seconds ago).", "LOW: Missing common claims: sub, aud, iat." ], "secondsToExpiry": -491778332, "signatureBytes": 32, "source": "computed locally", "summary": "Decoded a HS256 token with 2 flag(s); signature NOT verified.", "verdict": "DECODED_WITH_PROBLEMS" }, "type": "json" }