How to decode jwt token in POSTMAN?

user_14619476 0
Viewed 3264

I want to decode jwt token that I received using Postman and implement it in REST API. How can I do that? I saw people posted code to decode the jwt token (reference: How to decode jwt token in javascript without using a library?) but I dont understand how to do it in postman? What url needed to decode the jwt? What headers, authorisation needed?

jwt postman
4 Answers

Postman supports cryptojs library : https://learning.postman.com/docs/writing-scripts/script-references/postman-sandbox-api-reference/#using-external-libraries

Add below example to postman test script:

let jwt = `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ0b3B0YWwuY29tIiwiZXhwIjoxNDI2NDIwODAwLCJodHRwOi8vdG9wdGFsLmNvbS9qd3RfY2xhaW1zL2lzX2FkbWluIjp0cnVlLCJjb21wYW55IjoiVG9wdGFsIiwiYXdlc29tZSI6dHJ1ZX0.UsrGn95rk5DStcC_WwIr3WIv5rHe2IApX56I58l8uyo`

a = jwt.split('.');


//a.forEach(function (val) {
    var words = CryptoJS.enc.Base64.parse(a[1]);
    var textString = CryptoJS.enc.Utf8.stringify(words);

    console.log(textString)
//})

Output:

enter image description here

The hmacSHA256 is not an encryption algorithm but an Hashing algorithm so there is no way to decode it as hashing is one-way function.

as the last part is in the form

HMACSHA256 of ( base64(header) + "." + base64(body) )

you can try creating it and equating both are equal

user_67936370

You can manually parse using atob function that decodes a Base64 string. (https://developer.mozilla.org/pt-BR/docs/Web/API/atob)

And it's available on Postman scripts.

Something like this:

// Sample JWT
let jwt = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'

let [jwtHeader, jwtPayload, jwtSignature] = jwt.split('.')

let jwtPayloadJsonString = atob(jwtPayload)

console.log(jwtPayloadJsonString)

let jwtPayloadJson = JSON.parse(jwtPayloadJsonString)

console.log(jwtPayloadJson)
user_29170490

https://jwt.io/ if you'd like, which can solve your problem, you can also download some plugins if you use any IDE

user_53836860

Building on PDHide’s answer, I came up with this ready-to-use snippet for Postman:

var jsonData = JSON.parse(responseBody);

let [header, payload, signature] = jsonData.access_token.split('.');

function decode(x) {
    let wordArray = CryptoJS.enc.Base64.parse(x);
    let str = CryptoJS.enc.Utf8.stringify(wordArray);
    return JSON.parse(str);
}

console.log("Header: ", decode(header));
console.log("Payload: ", decode(payload));

See this link for more information on the three parts of a JSON Web Token (header, payload and signature).

user_94501520
Related