jwt-simple

Warning

This project is no longer maintained. No further updates or security fixes will be provided. Please migrate to an actively maintained library such as jose or jsonwebtoken.

If you continue to use jwt-simple, always pass the expected algorithm to jwt.decode (e.g. jwt.decode(token, key, false, 'RS256')) instead of relying on the alg header of the token.

JWT(JSON Web Token) encode and decode module for node.js.

Install

$ npm install jwt-simple

Usage

let jwt = require('jwt-simple');
let payload = { foo: 'bar' };
let secret = 'xxx';

// HS256 secrets are typically 128-bit random strings, for example hex-encoded:
// let secret = Buffer.from('fe1a1915a379f3be5394b64d14794932', 'hex')

// encode
let token = jwt.encode(payload, secret);

// decode
let decoded = jwt.decode(token, secret);
console.log(decoded); //=> { foo: 'bar' }

decode params

/*
 * jwt.decode(token, key, noVerify, algorithm)
 */

// decode, by default the signature of the token is verified
let decoded = jwt.decode(token, secret);
console.log(decoded); //=> { foo: 'bar' }

// decode without verify the signature of the token,
// be sure to KNOW WHAT ARE YOU DOING because not verify the signature
// means you can't be sure that someone hasn't modified the token payload
let decoded = jwt.decode(token, secret, true);
console.log(decoded); //=> { foo: 'bar' }

// decode with a specific algorithm (not using the algorithm described in the token payload)
let decoded = jwt.decode(token, secret, false, 'HS256');
console.log(decoded); //=> { foo: 'bar' }

Algorithms

By default the algorithm to encode is HS256.

The supported algorithms for encoding and decoding are HS256, HS384, HS512 and RS256.

// encode using HS512
jwt.encode(payload, secret, 'HS512')