jwt-token-cli

Decode and inspect JWT tokens from the command line. Zero npm dependencies — pure Node.js.

Note: This tool decodes tokens (base64url) but does not cryptographically verify signatures. Use jsonwebtoken or jose for signature verification.

Install

npm install -g jwt-token-cli

Usage

# Inline token
jwt-decode eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# Pipe from stdin
echo $TOKEN | jwt-decode
cat token.txt | jwt-decode

# Read from file
jwt-decode --file token.txt

# Strip Bearer prefix automatically
jwt-decode "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Options

| Flag | Description | |------|-------------| | --json | Output raw decoded JSON (header + payload) | | --check | Exit code 0 if valid, 1 if expired (for use in shell scripts) | | --file <path> | Read token from a file | | --no-color | Disable colored output | | --help | Show usage |

Output

╔══ HEADER ══════════════════════════════════════════
║
║ alg  HS256 (algorithm)
║ typ  JWT
║
╠══ PAYLOAD ══════════════════════════════════════════
║
║ iss   https://auth.example.com (Issuer)
║ sub   user_abc123 (Subject)
║ aud   myapp (Audience)
║ exp   2025-12-31 23:59:59 UTC
║       → expires in 3 days
║ iat   2025-12-28 10:00:00 UTC (Issued At)
║
║ ── custom claims ──
║ name                 Alice Smith
║ role                 admin
║ email                [email protected]
║
╠══ SIGNATURE ════════════════════════════════════════
║ Status  ⚠ NOT VERIFIED (decode-only mode)
║ Value   SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c…
║
╠══ STATUS ═══════════════════════════════════════════
║ ✓ VALID (not expired)
║
╚═════════════════════════════════════════════════════

Script usage (--check)

# Use in CI/CD to validate token freshness
jwt-decode $TOKEN --check && echo "Token OK, proceeding..." || echo "Token expired, re-authenticate"

# Combine with --json for machine-readable output
jwt-decode $TOKEN --json | jq '.payload.sub'

Examples

# Get just the payload as JSON
echo $TOKEN | jwt-decode --json

# Extract a specific claim
echo $TOKEN | jwt-decode --json | node -e "const d=require('fs').readFileSync('/dev/stdin','utf8'); console.log(JSON.parse(d).payload.sub)"

# Check expiry in a script
if jwt-decode --file /var/run/token.txt --check; then
  echo "Token valid"
fi

# No color for log files
jwt-decode $TOKEN --no-color >> token-audit.log

Features

• Zero dependencies — uses only Node.js built-ins (Buffer, fs, readline)
• Reads from: argument, stdin pipe, or --file
• Highlights expiry: "expires in 3 hours" / "expired 2 days ago"
• Human-readable timestamps for exp, iat, nbf
• --check flag for scripting (exit code 1 = expired)
• Automatically strips Bearer prefix
• --json for machine-readable output
• Colored output with --no-color override

License

MIT