JWT API
A JWT decode, verify and sign HTTP API is planned, but it is not built yet and not available. This page is a waitlist: join it if you would use it. The public JWT decoder works today.
What it might be used for (planned)
- Side services that need ad-hoc verification — Slack bots that check whether a paste is a valid JWT, audit tools, support dashboards.
- Bulk validation — pipelines that check many tokens at once. How keys or JWKS URLs would be handled has not been decided.
- Introspection-as-a-service — pretty-print +
anomaly flagging for support tooling (e.g., "this token has
alg:none", "thisissisn't in your allowlist").
Join the waitlist
Related
FAQ
Why a JWT API when every language has a JWT library?
You typically don't need this for production decode/verify — your own server can do that locally. If we build the API, the ideas are: (1) side-services that need ad-hoc verification (Slack bots, audit tools), (2) bulk-validation pipelines, and (3) introspection for support tooling (pretty-print + flagged anomalies). None of this exists yet.
What is planned?
Ideas we are considering, none of them built: a decode endpoint (splits and parses a token, no key needed), a verify endpoint, a sign endpoint limited to HS256, and bulk versions of each. How keys or JWKS URLs would be handled has not been decided.
Is there pricing?
No. Nothing is built, so there is no price, plan or free tier. Joining the waitlist does not commit you to anything.
Will you ever see my secrets?
Nothing is built, so no service receives your secrets today. Please don't put a secret or a real token in the waitlist form. If an API like this were built, verifying an HS256 token would mean sending the secret to a server, so keep HS256 verification on your own machine. The public Verify HMAC tool is the alternative.