Should I use `jsonwebtoken` or `jose` in a new Node.js project?

`jose` for anything new. It's actively maintained by the panva GitHub org (the OIDC spec contributors), ESM-first, fully async, supports every algorithm in the JOSE family, and integrates cleanly with Web Crypto. `jsonwebtoken` is stable but slow to add modern algorithms and uses synchronous APIs that block the event loop. Migrate when convenient.

How do I verify a JWT in Node.js with `jose`?

Use `jwtVerify`: `const { payload } = await jwtVerify(token, await createRemoteJWKSet(new URL(jwksUrl)), { issuer, audience })`. `createRemoteJWKSet` caches the JWKS in memory and rotates keys automatically based on the token's `kid` header, the right pattern for any tokens you didn't issue yourself.

Why does `jwt.verify()` throw `JsonWebTokenError: invalid signature`?

Almost always one of three things: (1) you're verifying with the wrong key (HS256 secret vs RS256 public key mismatch), (2) the token was issued by a different `kid` than the one you fetched, or (3) the token was tampered with. Use the decoder above to confirm the `alg` and `kid` header values, then double-check those against your verification key.

How do I read claims from a JWT without verifying (for debugging only)?

`jsonwebtoken` has `jwt.decode(token)` which skips verification. `jose` has `decodeJwt(token)` and `decodeProtectedHeader(token)`. Use these only for logging or debugging, never make a security decision based on an unverified token, since an attacker can craft any payload they want.

What's the right way to handle JWT expiry in Express middleware?

Let your verifier do it. Both `jsonwebtoken` and `jose` reject expired tokens by default (raising `TokenExpiredError` and `JWTExpired` respectively). Catch that specific error class and return 401 with `WWW-Authenticate: Bearer error="invalid_token"`. Don't compare `exp` yourself, clock skew handling and leeway is non-trivial.

👤

JWT Decoder

100% Local

Decode and inspect JSON Web Tokens safely.

JWT Decoder

nodejs Edition

JWT Decoder for Node.js

AllDevToolsHub's JWT Decoder for Node.js is a free, browser-based decoder for inspecting JWTs the way `jsonwebtoken`, `jose`, and `fast-jwt` will parse them on your server. Paste a token and the decoder splits it into header, payload, and signature, Base64URL-decodes each, and renders the claims as syntax-highlighted JSON. The token never leaves your browser, useful when you need to debug a production Authorization header without copying it to a third-party site. Node has three dominant JWT libraries. `jsonwebtoken` (npm: `jsonwebtoken`) is the legacy default, synchronous, CommonJS-first. `jose` is the modern, RFC-compliant, async, ESM-first choice and what most new Node.js projects should use. `fast-jwt` is a performance-focused alternative used inside Fastify. All three accept the same token format, but they differ on key handling: `jsonwebtoken` accepts a PEM string or Buffer; `jose` uses key objects from `createSecretKey()`, `importPKCS8()`, or `importJWK()`. The decoder works with tokens from any of them. Common Node.js workflows where this decoder helps: debugging Auth0 / Clerk / Supabase tokens in an Express or Next.js middleware, inspecting `aud` to confirm a token is for the right API, checking `exp` against `Date.now()` to diagnose timing bugs, and reading the `kid` header to identify which key in your JWKS endpoint signed the token before calling `createRemoteJWKSet`.

Verify with jose (modern)javascript

import { jwtVerify, createRemoteJWKSet } from "jose";

const JWKS = createRemoteJWKSet(
  new URL("https://example.auth0.com/.well-known/jwks.json")
);

const { payload } = await jwtVerify(token, JWKS, {
  issuer: "https://example.auth0.com/",
  audience: "https://api.example.com",
});
console.log(payload.sub, payload.exp);

Decode without verifying (debug only)javascript

import { decodeJwt, decodeProtectedHeader } from "jose";

const header = decodeProtectedHeader(token);
const claims = decodeJwt(token);
console.log({ alg: header.alg, kid: header.kid, sub: claims.sub });

Looking for the general tool?JWT Decoder

Paste JWT Token

Waiting for valid token...

Zero Trust Policy

This decoder runs entirely in your browser. The token is never sent to our servers.

Try:

Privacy note

This tool runs entirely in your browser. Your input is never uploaded, logged, or sent to AllDevToolsHub or anyone else, and it keeps working offline once the page has loaded.

How to Use JWT Decoder

Paste JWT

Paste the full token (header.payload.signature) into the input field.

Auto-Decode

The header and payload decode instantly as you type, no button needed.

Inspect Claims

Read the Header and Payload cards to see algorithm, expiry, issuer, and custom claims.

Copy Sections

Copy the decoded header or payload JSON individually for use in bug reports or docs.

JWT Decoder: the essentials

AllDevToolsHub's JWT Decoder is a free, browser-based tool that decodes JSON Web Tokens and inspects their header, payload, and signature without ever sending the token to a server. No installation or account required, all decoding happens locally in your browser. It splits a JWT into its three Base64URL-encoded parts, shows the decoded JSON of each, and surfaces expiry warnings, claim explanations, and algorithm metadata. Access tokens, refresh tokens, and ID tokens never leave the browser tab. Suitable for debugging OAuth 2.0 flows, OpenID Connect ID tokens, custom API auth, and inspecting tokens captured in production traffic.

Key points

Encodes and decodes data locally with zero network requests, safe for sensitive payloads.
Handles edge cases like empty input, large payloads, and mixed encodings.
Follows relevant RFC standards for spec-compliant output.

Learn More

JWT Security 101: How to Audit Tokens Without Leaking Secrets

Read Article

JWT Tokens Explained: Decode, Verify & Common Mistakes (2026 Guide)

Read Article

We Fed 200 Malformed JWTs to 5 Libraries: What Actually Broke

A practical test of JWT validation behavior across major libraries, focusing on algorithm confusion, exp requirements, malformed encoding, and real-world verification failures.

Read Article

Overview

What is JWT Decoder?

Paste any JWT to inspect its header, payload, and signature. All decoding happens locally in your browser for maximum security, no token ever leaves the page.

FAQ

Frequently Asked Questions

Reference

Technical Deep Dive

JWT Decoder

JSON Web Tokens (JWT) are a central part of modern authentication. This tool lets you paste any JWT to see its header, payload, and signature components. All decoding happens locally in your browser for maximum security.

jwt.io will decode a token and, by default, you still pasted it into someone else’s page. This decoder only Base64URL-splits the three segments locally.

Paste a three-part token. Header should show alg and typ. Payload should show exp as a date you can read. Signature is bytes, not a verified trust decision.

This does not verify signatures. An alg:none token still decodes. Use the JWT tool plus a public key when you need verify.

01 Registered Claims Protocol

Claim	Standard Name	Description
`iss`	Issuer	The authority that issued the JWT
`sub`	Subject	The unique identifier for the user (sub)
`aud`	Audience	The intended recipient (Client ID)
`exp`	Expiration	Validity deadline (Unix Timestamp)
`iat`	Issued At	Token creation timestamp

02 Decoding & Verification Workflow

Segment Splitting The raw string is split by the . delimiter into Header, Payload, and Signature components.

Base64URL Normalization Segments are transformed from URL-safe Base64 to standard binary streams, handling padding and alphabet shifts.

JSON Reification Binary data is parsed into a JavaScript object tree, and expiry claims are checked against the current browser clock.

03 Decode-First Workflows

This tool is a one-way decoder, no signing, no minting, no secret-handling. These are the moments when "just show me what's in the token" is the entire job.

👀

Peek at the claims, no verification needed Copy the token out of a network request, paste, read. You want to know what's inside, sub, scope, custom claims, without setting up a keychain or running a Node REPL.
⏳

Figure out exactly when a token expired A user reports "session randomly dropped." Paste their token; the decoder renders exp as an ISO 8601 timestamp. Now you can correlate against logs at that exact second.
🔁

Decode an SSO redirect for a bug report The token comes back in a fragment after an SSO bounce. You need a clean screenshot of header + payload to attach to a ticket, without leaking the signature segment or pasting the secret anywhere.
🎓

Classroom or onboarding demo Show a new engineer that a JWT is not encrypted, three Base64URL segments, anyone with the token can read its contents. The decoder makes "signed, not secret" concrete in 10 seconds.
🔑

Identify which JWKS key signed a token The header's kid points to one entry in the issuer's .well-known/jwks.json. Reading the kid tells you which key to fetch from the JWKS endpoint to verify in your backend.

04 Worked Examples

EXAMPLE 1 · CLAIMS WITH HUMAN-READABLE TIMESTAMPS

Decoded payload as the RFC 7519 spec stores it (Unix seconds):

{

"iss": "https://auth.example.com", "sub": "user_42a7", "aud": "api://app", "iat": 1748304000, "exp": 1748307600, "scope": "read:profile write:posts" }

Same payload, rendered by the decoder for humans:

iat: 1748304000 → 2026-05-27T00:00:00Z (issued 1h ago)
exp: 1748307600 → 2026-05-27T01:00:00Z (expires in 0m, valid)
scope: read:profile, write:posts

RFC 7519 §2 defines iat/exp/nbf as "NumericDate", seconds since epoch. The decoder keeps the raw int visible so you can paste it into a log query, and renders the ISO 8601 form so you can read it.

EXAMPLE 2 · JWE (5 SEGMENTS) vs JWS (3 SEGMENTS)

Count the dots before you try to decode:

JWS (signed):    header . payload . signature        → 2 dots
JWE (encrypted): header . key . iv . ciphertext . tag → 4 dots

What the decoder shows for each:

3-segment input → header + payload decoded as JSON
5-segment input → header decoded (alg/enc visible),
                  body remains opaque ciphertext (RFC 7516)

JWE per RFC 7516 actually encrypts the payload, no decoder without the recipient's key can read it. If your "JWT" has 4 dots, you have a JWE, and only the holder of the decryption key can see the claims.

EXAMPLE 3 · USING THE HEADER'S kid TO FIND THE PUBLIC KEY

Decoded header from an Auth0-issued token:

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "QkVDQ0NEMzlEMUVDMTYxMTYzNkE4M0E4Q0Y"
}

How the verifier resolves the key (backend, not this tool):

GET https://{issuer}/.well-known/jwks.json
→ pick the JWK where jwk.kid === "QkVDQ0NEMzlEMUVDMTYxMTYzNkE4M0E4Q0Y"
→ that JWK's n/e fields are the RSA public key
→ verify token signature with that key

The decoder surfaces the kid so you know which key your backend library will fetch. Issuers rotate keys (multiple kids coexist in a JWKS for a grace window), matching by kid is what makes rotation safe.

05 Related Tools

Decoding is the read-only half of JWT work. For signing, verifying, generating, and reference lookups, hop to the dedicated tool.

🛠

Compare With

🔐

Base64 Encoder

You Might Also Need

🛡️

JWT Generator & Decoder

Generate, decode and verify JSON Web Tokens safely.

Open Tool

🔐

Base64 Encoder

Encode and decode text to Base64 format.

Open Tool

🗝️

RSA Key Pair Generator

Generate RSA-OAEP or RSA-PSS key pairs in PEM format using Web Crypto API.

Open Tool

🗝️

Password Entropy Calculator

Calculate the exact Shannon entropy of your passwords.

Open Tool

🔐

Bcrypt Hash Generator

Generate and verify Bcrypt hashes securely.

Open Tool

RJRahul JalavadiyaFounder & Lead Engineer

Last reviewed 2026-07-29

JWT Decoder

JWT Decoder for Node.js

Privacy note

How to Use JWT Decoder

Paste JWT

Auto-Decode

Inspect Claims

Copy Sections

JWT Decoder: the essentials

Key points

Learn More

JWT Security 101: How to Audit Tokens Without Leaking Secrets

JWT Tokens Explained: Decode, Verify & Common Mistakes (2026 Guide)

We Fed 200 Malformed JWTs to 5 Libraries: What Actually Broke

What is JWT Decoder?

Frequently Asked Questions

Technical Deep Dive

JWT Decoder

01 Registered Claims Protocol

02 Decoding & Verification Workflow

03 Decode-First Workflows

04 Worked Examples

05 Related Tools

JWT Tool (Sign / Verify)

JWT Claims Reference

Timestamp Converter

Runs 100% in your browser

Compare With

Base64 Encoder

You Might Also Need

JWT Generator & Decoder

Base64 Encoder

RSA Key Pair Generator

Password Entropy Calculator

Bcrypt Hash Generator