jwt-decode
Advanced tools
Package description
The jwt-decode npm package is a small browser library that helps decoding JWTs token which are Base64Url encoded. It is particularly useful for getting the payload or header information out of a JWT token without verifying its signature.
Decode JWT Token
This feature allows you to decode a JWT token to retrieve the payload and header information. The code sample shows how to use jwt-decode to decode a token and log the decoded payload to the console.
var jwtDecode = require('jwt-decode');
var token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ';
var decoded = jwtDecode(token);
console.log(decoded);jsonwebtoken is a popular npm package that not only decodes JWT tokens but also verifies and signs them. It provides a full implementation of JSON Web Tokens, unlike jwt-decode which only decodes tokens without validation.
jws is a JSON Web Signature implementation that allows you to sign, verify, and decode JWTs. It is more feature-rich compared to jwt-decode, which only decodes tokens.
jwt-simple is another npm package that allows encoding and decoding JWT tokens. It is similar to jwt-decode but also offers the ability to encode tokens, which jwt-decode does not.
Changelog
Version 3.1.2
unknown by defaultJwtHeaderand JwtPayload that can be used with the generic return type as-is or extended.Readme
IMPORTANT: This library doesn't validate the token, any well formed JWT can be decoded. You should validate the token in your server-side logic by using something like express-jwt, koa-jwt, Owin Bearer JWT, etc.
Warning: When upgrading from version 2 to 3, there's a potentially breaking change
If you've previously imported the library as import * as jwt_decode from 'jwt-decode', you'll have to change your import to import jwt_decode from 'jwt-decode';.
Install with NPM or Yarn.
Run npm install jwt-decode or yarn add jwt-decode to install the library.
import jwt_decode from "jwt-decode";
var token = "eyJ0eXAiO.../// jwt token";
var decoded = jwt_decode(token);
console.log(decoded);
/* prints:
* { foo: "bar",
* exp: 1393286893,
* iat: 1393268893 }
*/
// decode header by passing in options (useful for when you need `kid` to verify a JWT):
var decodedHeader = jwt_decode(token, { header: true });
console.log(decodedHeader);
/* prints:
* { typ: "JWT",
* alg: "HS256" }
*/
Note: A falsy or malformed token will throw an InvalidTokenError error.
const jwt_decode = require('jwt-decode');
...
Copy the file jwt-decode.js from the build/ folder to your project somewhere, then include like so:
<script src="jwt-decode.js"></script>
If you want to use the library trough Bower, an HTML import, use version v2.2.0. It has the same functionality.
Run npm run dev, this will fire up a browser and watch the /lib folder.
If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.
This project is licensed under the MIT license. See the LICENSE file for more info.
FAQs
Decode JWT tokens, mostly useful for browser applications.
The npm package jwt-decode receives a total of 3,898,635 weekly downloads. As such, jwt-decode popularity was classified as popular.
We found that jwt-decode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 46 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A hospital in Mobile, Alabama, agreed to a settlement in a landmark ransomware death lawsuit, but is now reportedly reconsidering the agreement and refusing to pay.
Security News
A new report explores how advancements in LLMs are enhancing cyber threats, including polymorphic malware, personalized spearphishing, and the risk of hijacking customer service bots.
Security News
ESLint has approved an RFC that adds support for TypeScript configuration files, which is aimed at improving the developer experience and recognizing changes in the evolving JavaScript ecosystem.