JWT Decoder

function decodeJWT(token) {
  const parts = token.split('.');
  if (parts.length < 2 || parts.length > 3) {
    throw new Error('Invalid JWT: expected 2 or 3 parts');
  }

  function base64URLDecode(str) {
    let base64 = str.replace(/-/g, '+').replace(/_/g, '/');
    while (base64.length % 4) base64 += '=';
    return JSON.parse(decodeURIComponent(
      atob(base64).split('').map(c =>
        '%' + c.charCodeAt(0).toString(16).padStart(2, '0')
      ).join('')
    ));
  }

  const header = base64URLDecode(parts[0]);
  const payload = base64URLDecode(parts[1]);
  const signature = parts[2] || null;

  // Check expiration
  const now = Math.floor(Date.now() / 1000);
  const isExpired = payload.exp ? payload.exp < now : false;
  const isNotYetValid = payload.nbf ? payload.nbf > now : false;

  return {
    header,
    payload,
    signature,
    isExpired,
    isNotYetValid,
    expiresIn: payload.exp ? payload.exp - now + ' seconds' : 'no expiration set'
  };
}

// Usage
const token = 'eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiIxMjM0NTY3ODkwIn0.signature';
const decoded = decodeJWT(token);
console.log(decoded.header);   // { alg: 'HS256' }
console.log(decoded.payload);  // { userId: '1234567890' }
console.log(decoded.isExpired); // true or false

function verifyJWTClaims(token, expected) {
  const decoded = decodeJWT(token);
  const errors = [];

  // Verify algorithm
  if (expected.alg && decoded.header.alg !== expected.alg) {
    errors.push(`Algorithm mismatch: expected ${expected.alg}, got ${decoded.header.alg}`);
  }

  // Reject 'none' algorithm
  if (decoded.header.alg === 'none') {
    errors.push('Insecure algorithm: none — token is unsigned');
  }

  // Verify audience
  if (expected.aud) {
    const audiences = Array.isArray(decoded.payload.aud)
      ? decoded.payload.aud : [decoded.payload.aud];
    if (!audiences.includes(expected.aud)) {
      errors.push(`Audience mismatch: expected ${expected.aud}`);
    }
  }

  // Verify expiration
  const now = Math.floor(Date.now() / 1000);
  if (decoded.payload.exp && decoded.payload.exp < now) {
    errors.push(`Token expired ${now - decoded.payload.exp} seconds ago`);
  }

  // Verify issuer
  if (expected.iss && decoded.payload.iss !== expected.iss) {
    errors.push(`Issuer mismatch: expected ${expected.iss}, got ${decoded.payload.iss}`);
  }

  return { valid: errors.length === 0, errors, decoded };
}

// Usage
const result = verifyJWTClaims(token, {
  alg: 'RS256',
  aud: 'api.example.com',
  iss: 'auth.example.com'
});
console.log(result.valid);   // true or false
console.log(result.errors);  // list of validation failures