How to decode and verify JWTs in Node.js

Install the jsonwebtoken package: npm install jsonwebtoken. To decode without verification (inspect claims): const decoded = jwt.decode(token, { complete: true }). To verify with a secret: const payload = jwt.verify(token, secretOrPublicKey). For RS256 tokens, pass the public key or certificate. Common pattern: try { const payload = jwt.verify(token, secret); } catch (err) { if (err.name === 'TokenExpiredError') { /* handle expiry */ } }. Use this tool to inspect token claims before writing verification logic.

// Node.js — decode and verify JWT tokens
import jwt from "jsonwebtoken";

// Decode WITHOUT verification (inspect only)
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header); // { alg: "RS256", typ: "JWT" }
console.log(decoded.payload); // { sub: "user-1", exp: ... }

// Verify with secret (recommended)
try {
  const verified = jwt.verify(token, process.env.JWT_SECRET);
  console.log("Valid:", verified.sub);
} catch (err) {
  console.error("Invalid token:", err.message);
  // "jwt expired", "invalid signature", etc.
}

Express JWT middleware pattern

Standard Express authentication middleware: const authMiddleware = (req, res, next) => { const token = req.headers.authorization?.split(' ')[1]; if (!token) return res.status(401).json({ error: 'No token' }); try { req.user = jwt.verify(token, process.env.JWT_SECRET); next(); } catch { res.status(403).json({ error: 'Invalid token' }); } }. For production, consider express-jwt or passport-jwt which handle edge cases. Always validate the iss (issuer) and aud (audience) claims in addition to the signature.

Debugging JWT issues in Node.js

Common JWT errors: 'jwt expired' (check exp claim — paste your token here to see the exact timestamp), 'invalid signature' (wrong secret/key or token was modified), 'jwt malformed' (not a valid JWT format — should be three dot-separated Base64URL segments), 'jwt not active' (nbf claim is in the future). The jsonwebtoken library also supports clockTolerance for clock skew between servers. For RS256/ES256, ensure you're using the matching public key — paste the token here to check the alg header.