Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/auth0/jwt-decode
Decode JWT tokens; useful for browser applications.
https://github.com/auth0/jwt-decode
dx-sdk jwt
Last synced: 3 days ago
JSON representation
Decode JWT tokens; useful for browser applications.
- Host: GitHub
- URL: https://github.com/auth0/jwt-decode
- Owner: auth0
- License: mit
- Created: 2014-02-24T19:18:02.000Z (almost 11 years ago)
- Default Branch: main
- Last Pushed: 2024-09-17T02:12:05.000Z (3 months ago)
- Last Synced: 2024-12-02T12:08:41.018Z (10 days ago)
- Topics: dx-sdk, jwt
- Language: TypeScript
- Homepage:
- Size: 967 KB
- Stars: 3,220
- Watchers: 137
- Forks: 340
- Open Issues: 6
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
- awesome-jwt - jwt-decode - Decode JWT tokens, useful for browser applications. (Libraries / JavaScript)
README
**IMPORTANT:** This library doesn't validate the token, any well-formed JWT can be decoded. You should validate the token in your server-side logic by using something like [express-jwt](https://github.com/auth0/express-jwt), [koa-jwt](https://github.com/stiang/koa-jwt), [Microsoft.AspNetCore.Authentication.JwtBearer](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer), etc.
[](https://opensource.org/licenses/MIT)
[](https://circleci.com/gh/auth0/jwt-decode)
:books: [Documentation](#documentation) - :rocket: [Getting Started](#getting-started) - :speech_balloon: [Feedback](#feedback)
## Documentation
- [Docs site](https://www.auth0.com/docs) - explore our docs site and learn more about Auth0.
## Getting started
### Installation
Install with NPM or Yarn.
Run `npm install jwt-decode` or `yarn add jwt-decode` to install the library.
### Usage
```js
import { jwtDecode } from "jwt-decode";
const token = "eyJ0eXAiO.../// jwt token";
const decoded = jwtDecode(token);
console.log(decoded);
/* prints:
* {
* foo: "bar",
* exp: 1393286893,
* iat: 1393268893
* }
*/
// decode header by passing in options (useful for when you need `kid` to verify a JWT):
const decodedHeader = jwtDecode(token, { header: true });
console.log(decodedHeader);
/* prints:
* {
* typ: "JWT",
* alg: "HS256"
* }
*/
```
**Note:** A falsy or malformed token will throw an `InvalidTokenError` error; see below for more information on specific errors.
## Polyfilling atob
This library relies on `atob()`, which is a global function available on [all modern browsers as well as every supported node environment](https://developer.mozilla.org/en-US/docs/Web/API/atob#browser_compatibility).
In order to use `jwt-decode` in an environment that has no access to `atob()` (e.g. [React Native](https://github.com/facebook/hermes/issues/1178)), ensure to provide the corresponding polyfill in your application by using [`core-js/stable/atob`](https://www.npmjs.com/package/core-js):
```js
import "core-js/stable/atob";
```
Alternatively, you can also use [`base-64`](https://www.npmjs.com/package/base-64) and polyfill `global.atob` yourself:
```js
import { decode } from "base-64";
global.atob = decode;
```
## Errors
This library works with valid JSON web tokens. The basic format of these token is
```
[part1].[part2].[part3]
```
All parts are supposed to be valid base64 (url) encoded json.
Depending on the `{ header: }` option it will decode part 1 (only if header: true is specified) or part 2 (default)
Not adhering to the format will result in a `InvalidTokenError` with one of the following messages:
- `Invalid token specified: must be a string` => the token passed was not a string, this library only works on strings.
- `Invalid token specified: missing part #` => this probably means you are missing a dot (`.`) in the token
- `Invalid token specified: invalid base64 for part #` => the part could not be base64 decoded (the message should contain the error the base64 decoder gave)
- `Invalid token specified: invalid json for part #` => the part was correctly base64 decoded, however, the decoded value was not valid JSON (the message should contain the error the JSON parser gave)
#### Use with TypeScript
The return type of the `jwtDecode` function is determined by the `header` property of the object passed as the second argument. If omitted (or set to false), it'll use `JwtPayload`, when true it will use `JwtHeader`.
If needed, you can specify what the expected return type should be by passing a type argument to the `jwtDecode` function.
You can extend both `JwtHeader` and `JwtPayload` to include non-standard claims or properties.
```typescript
import { jwtDecode } from "jwt-decode";
const token = "eyJhsw5c";
const decoded = jwtDecode(token); // Returns with the JwtPayload type
```
#### Use as a CommonJS package
```javascript
const { jwtDecode } = require('jwt-decode');
...
```
#### Include with a script tag
Copy the file `jwt-decode.js` from the root of the `build/esm` folder to your project somewhere, then import `jwtDecode` from it inside a script tag that's marked with `type="module"`:
```html
import { jwtDecode } from "/path/to/jwt-decode.js";
const token = "eyJhsw5c";
const decoded = jwtDecode(token);
```
## Feedback
### Contributing
We appreciate feedback and contribution to this repo! Before you get started, please see the following:
- [Auth0's general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [Auth0's code of conduct guidelines](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
### Raise an issue
To provide feedback or report a bug, please [raise an issue on our issue tracker](https://github.com/auth0/jwt-decode/issues).
### Vulnerability Reporting
Please do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy) details the procedure for disclosing security issues.
---
Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout Why Auth0?
This project is licensed under the MIT license. See the LICENSE file for more info.