JWT Decoder

Decoding is not the same as verifying. Decoding just Base64URL-splits the three token sections and parses JSON. Verifying checks the signature against a secret or public key. Never trust decoded claims without verifying first.

Decode + verify in production code:

// Node.js / TypeScript — jsonwebtoken
const jwt = require('jsonwebtoken');

// Decode without verifying (quick inspection)
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header, decoded.payload);

// Verify + decode
try {
  const payload = jwt.verify(token, secretOrPublicKey);
} catch (e) {
  // expired, bad signature, wrong alg, etc.
}

# Python — PyJWT
import jwt
payload = jwt.decode(token, key, algorithms=['HS256', 'RS256'],
                     audience='your-api', issuer='your-auth-server')

// Java — jjwt (io.jsonwebtoken)
Jws<Claims> claims = Jwts.parserBuilder()
    .setSigningKey(key)
    .build()
    .parseClaimsJws(token);
Claims payload = claims.getBody();

// Go — golang-jwt/jwt
token, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
    return secretKey, nil
})
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
    fmt.Println(claims["sub"])
}

// C# / .NET — System.IdentityModel.Tokens.Jwt
var handler = new JwtSecurityTokenHandler();
var token = handler.ReadJwtToken(jwtString);
var claim = token.Claims.FirstOrDefault(c => c.Type == "sub");

1. Algorithm whitelist — never accept alg: none, never accept an algorithm the server didn't issue. Hard-code the expected alg (HS256 or RS256) rather than reading from the token header.
2. Signature verification — always check before trusting any claim. Decoding is not verification.
3. exp (expiration) — must be in the future. Library should enforce by default, but confirm.
4. nbf (not before) — must be in the past. Protects against tokens issued with a future activation time.
5. iat (issued at) — sanity-check isn't in the future (clock skew).
6. iss (issuer) — matches the auth server you trust, not some other issuer.
7. aud (audience) — matches your API identifier, not a different microservice's ID.
8. Token replay — for bearer tokens, either rotate frequently or track the jti claim server-side to detect reuse.

Tools like Auth0's express-oauth2-jwt-bearer middleware enforce all eight automatically. Rolling your own JWT validation is an easy place to get it wrong.