npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

jwt-decode

v4.0.0

Published

Decode JWT tokens, mostly useful for browser applications.

Downloads

30,390,002

Readme

Browser library that helps decoding JWT tokens which are Base64Url encoded

IMPORTANT: This library doesn't validate the token, any well-formed JWT can be decoded. You should validate the token in your server-side logic by using something like express-jwt, koa-jwt, Microsoft.AspNetCore.Authentication.JwtBearer, etc.

Release Downloads License CircleCI

:books: Documentation - :rocket: Getting Started - :speech_balloon: Feedback

Documentation

  • Docs site - explore our docs site and learn more about Auth0.

Getting started

Installation

Install with NPM or Yarn.

Run npm install jwt-decode or yarn add jwt-decode to install the library.

Usage

import { jwtDecode } from "jwt-decode";

const token = "eyJ0eXAiO.../// jwt token";
const decoded = jwtDecode(token);

console.log(decoded);

/* prints:
 * { 
 *   foo: "bar",
 *   exp: 1393286893,
 *   iat: 1393268893  
 * }
 */

// decode header by passing in options (useful for when you need `kid` to verify a JWT):
const decodedHeader = jwtDecode(token, { header: true });
console.log(decodedHeader);

/* prints:
 * { 
 *   typ: "JWT",
 *   alg: "HS256" 
 * }
 */

Note: A falsy or malformed token will throw an InvalidTokenError error; see below for more information on specific errors.

Errors

This library works with valid JSON web tokens. The basic format of these token is

[part1].[part2].[part3]

All parts are supposed to be valid base64 (url) encoded json. Depending on the { header: <option> } option it will decode part 1 (only if header: true is specified) or part 2 (default)

Not adhering to the format will result in a InvalidTokenError with one of the following messages:

  • Invalid token specified: must be a string => the token passed was not a string, this library only works on strings.
  • Invalid token specified: missing part # => this probably means you are missing a dot (.) in the token
  • Invalid token specified: invalid base64 for part # => the part could not be base64 decoded (the message should contain the error the base64 decoder gave)
  • Invalid token specified: invalid json for part # => the part was correctly base64 decoded, however, the decoded value was not valid JSON (the message should contain the error the JSON parser gave)

Use with TypeScript

The return type of the jwtDecode function is determined by the header property of the object passed as the second argument. If omitted (or set to false), it'll use JwtPayload, when true it will use JwtHeader. If needed, you can specify what the expected return type should be by passing a type argument to the jwtDecode function.

You can extend both JwtHeader and JwtPayload to include non-standard claims or properties.

import { jwtDecode } from "jwt-decode";

const token = "eyJhsw5c";
const decoded = jwtDecode<JwtPayload>(token); // Returns with the JwtPayload type

Use as a CommonJS package

const { jwtDecode } = require('jwt-decode');
...

Include with a script tag

Copy the file jwt-decode.js from the root of the build/esm folder to your project somewhere, then import jwtDecode from it inside a script tag that's marked with type="module":

<script type="module">
  import { jwtDecode } from "/path/to/jwt-decode.js";

  const token = "eyJhsw5c";
  const decoded = jwtDecode(token);
</script>

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability Reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.