1. Docs
  2. Formulas
  3. Functions

JWT_DECODE

Open markdown version

Decodes and optionally verifies a JWT token using the provided secret/key and algorithm. Returns an object containing the payload, header, and verification status.

Supports HMAC (HS256/HS384/HS512), RSA (RS256/RS384/RS512), and ECDSA (ES256/ES384/ES512) algorithms. Can validate standard JWT claims like exp, nbf, iss, aud, jti, sub, and custom required claims. Supports JWK (JSON Web Key) and JWKS (JSON Web Key Set) formats.

The options should be provided in the same manner as the options for the JWT.decode function (e.g., verify, jwks, verify_expiration, verify_not_before, leeway, iss/verify_iss, aud/verify_aud, sub/verify_sub, jti/verify_jti, required_claims). For example, to verify the iss claim: iss: "my-app", verify_iss: TRUE

Categories: Hashing/Signing

Syntax

JWT_DECODE(token, secret_or_key, algorithm, **options)

Examples

Example 1

Input

1
{
2
"token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxMjN9.FoW4dUPr9HWzOI8S7Ohpe3hGULZEJhNJeouOX8f1sz8"
3
}

Formula

JWT_DECODE(token, "secret", "HS256")

Output

1
{
2
"payload": {
3
"user_id": 123
4
},
5
"header": {
6
"alg": "HS256"
7
},
8
"verified": true
9
}

Example 2

Input

1
{
2
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxMjN9.invalid_signature"
3
}

Formula

JWT_DECODE(token, "secret", "HS256", verify: FALSE)

Output

1
{
2
"payload": {
3
"user_id": 123
4
},
5
"header": {
6
"typ": "JWT",
7
"alg": "HS256"
8
},
9
"verified": false
10
}

Example 3

Input

1
{
2
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJteWFwcCIsInVzZXJfaWQiOjEyM30.signature",
3
"rsa_public_key": "-----BEGIN PUBLIC KEY-----\\n...\\n-----END PUBLIC KEY-----"
4
}

Formula

JWT_DECODE(token, rsa_public_key, "RS256", iss: "myapp", verify_iss: TRUE)

Output

1
{
2
"payload": {
3
"iss": "myapp",
4
"user_id": 123
5
},
6
"header": {
7
"typ": "JWT",
8
"alg": "RS256"
9
},
10
"verified": true
11
}

Example 4

Input

1
{
2
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1c2VyX2lkIjoxMjN9.signature",
3
"jwk_key": {
4
"kty": "RSA",
5
"n": "base64url_encoded_modulus",
6
"e": "AQAB"
7
}
8
}

Formula

JWT_DECODE(token, jwk_key, "RS256")

Output

1
{
2
"payload": {
3
"user_id": 123
4
},
5
"header": {
6
"typ": "JWT",
7
"alg": "RS256"
8
},
9
"verified": true
10
}

Example 5

Input

1
{
2
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImtleS0xIn0.eyJ1c2VyX2lkIjoxMjN9.signature",
3
"jwks_set": {
4
"keys": [
5
{
6
"kty": "RSA",
7
"kid": "key-1",
8
"use": "sig",
9
"alg": "RS256",
10
"n": "base64url_encoded_modulus",
11
"e": "AQAB"
12
}
13
]
14
}
15
}

Formula

JWT_DECODE(token, NULL, "RS256", jwks: jwks_set)

Output

1
{
2
"payload": {
3
"user_id": 123
4
},
5
"header": {
6
"typ": "JWT",
7
"alg": "RS256",
8
"kid": "key-1"
9
},
10
"verified": true
11
}
Was this helpful?