How to Decode and Inspect JSON Web Tokens (JWT)

JSON Web Tokens (JWT) are a standard way to securely transmit information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

In this guide, we'll explain how to decode a JWT to view its header, payload claims, and how to inspect expiration times.

The Structure of a JWT

A JSON Web Token consists of three parts separated by dots (.):

1. Header: Contains metadata about the type of token and the signing algorithm used (e.g. HS256, RS256).
2. Payload: Contains the claims. Claims are statements about an entity (typically, the user) and additional data (e.g. sub, name, admin, exp).
3. Signature: Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way.

Encoded JWT Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjI1MTYyMzkwMjIsImFkbWluIjp0cnVlfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decoding the Header and Payload

The Header and Payload of a JWT are simply Base64URL-encoded strings. To decode them client-side:

1. Split the token on the . character.
2. Replace url-safe characters (- to +, _ to /) and apply padding.
3. Use a standard Base64 decoder to parse the binary data back into a readable JSON string.

Understanding Token Expiration

Standard claims are usually represented by 3-character keys:

• exp (Expiration Time): The epoch timestamp after which the token must not be accepted.
• iat (Issued At): The epoch timestamp at which the token was created.
• nbf (Not Before): The epoch timestamp before which the token must not be accepted.

Always verify that exp * 1000 is greater than the current local timestamp Date.now() to ensure the session remains active.