jws.decode / jws.decodeProtectedHeader

Parse a compact JWS without verifying the signature. For inspection, kid extraction before choosing a resolver, or debugging a token pulled out of a log.

decode(token)

import { decode } from '@exortek/jws'
 
const { header, payload, signature } = decode(token)
// header:    { alg: 'ES256', kid: 'k1', ... }
// payload:   whatever was signed — object, string, or Buffer
// signature: raw bytes as a Buffer

Payload decoding follows the compact-verify heuristic:

• If the header’s b64 is false (RFC 7797), the payload segment is returned as-is (string).
• Otherwise the base64url segment is decoded and parsed as JSON.
• If JSON parse fails, the raw bytes are returned as a Buffer.

decodeProtectedHeader(token)

Reads only the header — handy when the very next step is picking a resolver keyed by kid:

import { decodeProtectedHeader, verify } from '@exortek/jws'
 
const { kid, alg } = decodeProtectedHeader(token)
const key = await store.get(kid)
await verify(token, key, { alg: [alg] })

Errors