jwt-decode is a browser library that decodes JWT tokens by extracting and parsing their Base64Url-encoded components.
The library solves the problem of extracting claims and header information from JSON Web Tokens in client-side applications. It works by parsing the three dot-separated parts of a JWT and decoding the specified section (header or payload) from Base64Url format into readable JSON. The library explicitly does not validate tokens—it only decodes well-formed JWTs. The README emphasizes that token validation must occur on the server side using appropriate middleware or authentication libraries.
The tool suits browser applications and client-side JavaScript environments where you need to inspect token contents after receiving them from an authentication server. It works in modern browsers and supported Node.js environments that have access to the atob() function. For environments without atob() support, such as older React Native versions, the library requires a polyfill. The README names express-jwt, koa-jwt, and Microsoft.AspNetCore.Authentication.JwtBearer as server-side validation alternatives but makes no comparisons to other client-side decoding libraries.
The project maintains active CI/CD automation through CircleCI. The library provides detailed error handling with specific InvalidTokenError messages for malformed tokens, missing parts, invalid Base64 encoding, or invalid JSON. TypeScript support includes generic type parameters allowing developers to specify expected return types and extend the standard JwtPayload and JwtHeader interfaces for custom claims.
