Decode a JWT with jose
Decoding reads what is inside a token, its header and claims, before the token is validated.
How it works
- Make a sample token. The code signs a token with
SignJWTand adds akidto the protected header so there is something to inspect. [1] - Decode the header.
decodeProtectedHeader(jwt)returns the header object, so the code can printalg,typandkid. [1] - Decode the claims.
decodeJwt(jwt)returns the claims set. The README lists it as a step before validation, so this example decodes only and does not verify the signature. [1]
Run and edit it
It runs in your browser, in a sandboxed frame that cannot see this site; the packages load from esm.sh only after you press Run.
import { SignJWT, decodeJwt, decodeProtectedHeader } from 'jose'
const secret = new TextEncoder().encode('demo-secret-at-least-32-bytes-long!!')
const jwt = await new SignJWT({ name: 'Ada', roles: ['admin', 'billing'] })
.setProtectedHeader({ alg: 'HS256', typ: 'JWT', kid: 'key-2024-01' })
.setSubject('user-42')
.setIssuedAt()
.setExpirationTime('1h')
.sign(secret)
console.log('token:', jwt.slice(0, 44) + '...')
const header = decodeProtectedHeader(jwt)
console.log('header.alg:', header.alg)
console.log('header.typ:', header.typ)
console.log('header.kid:', header.kid)
const claims = decodeJwt(jwt)
console.log('claims.sub:', claims.sub)
console.log('claims.name:', claims.name)
console.log('claims.roles:', claims.roles.join(', '))
console.log('issued at:', new Date(claims.iat * 1000).toISOString())
console.log('expires at:', new Date(claims.exp * 1000).toISOString())
Paste a token from your own app into the jwt variable to see its header and claims. Code written by AgentGid [1].
Paste a token from your own app into the jwt variable to see its header and claims. Code written by AgentGid [1].Checked Oct 12, 2026: it starts without errors in Chromium with jose 6.2.12. Needs WebGL.
More jose examples
Sign a JWT with jose Verify a JWT with jose Generate keys and export a JWK with jose Encrypt and decrypt a JWT with jose
Sources
Explanations written by AgentGid from the official docs; the numbers in brackets point here. The code marked "written by AgentGid" is ours and free to copy.