# How to decode JWT?

**URL:** https://discourse.nodered.org/t/how-to-decode-jwt/68427
**Category:** General
**Created:** [30 September 2022 19:21 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427 "2022-09-30T19:21:51Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![network\_potato](https://avatars.discourse-cdn.com/v4/letter/n/59ef9b/32.png) [@network\_potato](https://discourse.nodered.org/u/network_potato)
#### Post date: [30 September 2022 19:21 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427/1 "2022-09-30T19:21:51Z")

</div>

I have set up a webhook from Shipmondo and added a secret key (they won't let you create a WH without one):

> **[Set up webhook](https://help.shipmondo.com/en/articles/4947096-set-up-webhook)**
>
> How to create webhooks for your shipments, orders and drafts in Shipmondo.

Receiving the message in Node-RED, the payload is encrypted.

I now need to decrypt the payload. I have tried using `node-red-contrib-auth` with the [following guide](https://www.compose.com/articles/authenticating-node-red-with-jsonwebtoken/) but the result is still encrypted.

Here is the flow:

```auto
{"_msgid":"9402f88c6802448e","payload":{"data":"eyJhbGciOiJIUzI1NiJ9.IntcImFjdGlvblwiOlwiY29ubmVjdGlvbl90ZXN0XCIsXCJkYXRhXCI6e319Ig.Z4uoPKAYB9Mze_amXlttnzDC3aip3SqOy4yex-pFemc"},"req":{"_readableState":{"objectMode":false,"highWaterMark":16384,"buffer":{"head":null,"tail":null,"length":0},"length":0,"pipes":[],"flowing":true,"ended":true,"endEmitted":true,"reading":false,"sync":false,"needReadable":false,"emittedReadable":false,"readableListening":false,"resumeScheduled":false,"errorEmitted":false,"emitClose":true,"autoDestroy":false,"destroyed":false,"errored":null,"closed":false,"closeEmitted":false,"defaultEncoding":"utf8","awaitDrainWriters":null,"multiAwaitDrain":false,"readingMore":false,"dataEmitted":true,"decoder":null,"encoding":null},"_events":{},"_eventsCount":1,"socket":"[internal]","httpVersionMajor":1,"httpVersionMinor":1,"httpVersion":"1.1","complete":true,"headers":{"connection":"close","host":"a1.confluent.as","x-forwarded-scheme":"https","x-forwarded-proto":"https","x-forwarded-for":"34.240.195.248","x-real-ip":"34.240.195.248","content-length":"138","smd-resource-type":"Shipments","smd-webhook-name":"test","smd-action":"create","smd-user":"Sileco AS","content-type":"application/json","accept-encoding":"gzip;q=1.0,deflate;q=0.6,identity;q=0.3","accept":"*/*","user-agent":"Ruby","x-newrelic-id":"UwYHVVBQGwcCUFBQBgg=","x-newrelic-transaction":"PxQOWF8HXANTVQBTA1IHVwEFFB8EBw8RVU4aWwEBUFYDBggAAFVQUlVTA0NKQQEFU1dQUgFVFTs="},"rawHeaders":["Connection","close","Host","a1.confluent.as","X-Forwarded-Scheme","https","X-Forwarded-Proto","https","X-Forwarded-For","34.240.195.248","X-Real-IP","34.240.195.248","Content-Length","138","Smd-Resource-Type","Shipments","Smd-Webhook-Name","test","Smd-Action","create","Smd-User","Sileco AS","Content-Type","application/json","Accept-Encoding","gzip;q=1.0,deflate;q=0.6,identity;q=0.3","Accept","*/*","User-Agent","Ruby","X-Newrelic-Id","UwYHVVBQGwcCUFBQBgg=","X-Newrelic-Transaction","PxQOWF8HXANTVQBTA1IHVwEFFB8EBw8RVU4aWwEBUFYDBggAAFVQUlVTA0NKQQEFU1dQUgFVFTs="],"trailers":{},"rawTrailers":[],"aborted":false,"upgrade":false,"url":"/whtest","method":"POST","statusCode":null,"statusMessage":null,"client":"[internal]","_consuming":true,"_dumped":false,"baseUrl":"","originalUrl":"/whtest","_parsedUrl":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":null,"query":null,"pathname":"/whtest","path":"/whtest","href":"/whtest","_raw":"/whtest"},"params":{},"query":{},"res":"[internal]","body":{"data":"eyJhbGciOiJIUzI1NiJ9.IntcImFjdGlvblwiOlwiY29ubmVjdGlvbl90ZXN0XCIsXCJkYXRhXCI6e319Ig.Z4uoPKAYB9Mze_amXlttnzDC3aip3SqOy4yex-pFemc"},"_body":true,"_passport":{"instance":{"_key":"passport","_strategies":{"session":{"name":"session","_key":"passport"},"bearer":{"name":"bearer","_realm":"Users"},"oauth2-client-password":{"name":"oauth2-client-password"},"anon":{"name":"anon"},"tokens":{"name":"tokens"}},"_serializers":[],"_deserializers":[],"_infoTransformers":[],"_framework":{},"_sm":{"_key":"passport"},"strategies":{},"_userProperty":"user"}},"route":{"path":"/whtest","stack":[{"name":"cookieParser","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"httpMiddleware","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"corsHandler","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"metricsHandler","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"jsonParser","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"urlencodedParser","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"multipartParser","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"rawBodyParser","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"<anonymous>","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"},{"name":"<anonymous>","keys":[],"regexp":{" __enc__":true,"type":"regexp","data":"/^\\/?$/i"},"method":"post"}],"methods":{"post":true}},"cookies":{},"signedCookies":{}},"res":{},"token":{"access_token":"eyJhbGciOiJIUzI1NiJ9.IntcImFjdGlvblwiOlwiY29ubmVjdGlvbl90ZXN0XCIsXCJkYXRhXCI6e319Ig.Z4uoPKAYB9Mze_amXlttnzDC3aip3SqOy4yex-pFemc"},"error":{"message":"TypeError: jwtString.split is not a function","code":"general"}}

```

The key to decrypt the message is `whtest1234`.

Can anyone help me find a working method to decrypt the payload?

---

<div class="post-metadata">

### Author: ![UnborN](https://avatars.discourse-cdn.com/v4/letter/u/4491bb/32.png) [@UnborN](https://discourse.nodered.org/u/UnborN)
#### Post date: [30 September 2022 20:05 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427/2 "2022-09-30T20:05:14Z")

</div>

[node-red-contrib-jwt](https://flows.nodered.org/node/node-red-contrib-jwt) seems to work to decode it

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/a/7/a729fbd71ca6aaff170ef12d2ffbfb44deda074c.png)

Test Flow

```auto
[{"id":"09d4dfb3b970c52f","type":"inject","z":"54efb553244c241f","name":"","props":[{"p":"payload"},{"p":"topic","vt":"str"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","payload":"","payloadType":"date","x":270,"y":2180,"wires":[["2afde891275a7636"]]},{"id":"2afde891275a7636","type":"function","z":"54efb553244c241f","name":"data","func":"msg = {\n \"payload\":\n \"eyJhbGciOiJIUzI1NiJ9.IntcImFjdGlvblwiOlwiY29ubmVjdGlvbl90ZXN0XCIsXCJkYXRhXCI6e319Ig.Z4uoPKAYB9Mze_amXlttnzDC3aip3SqOy4yex-pFemc\"\n\n}\n\nreturn msg;","outputs":1,"noerr":0,"initialize":"","finalize":"","libs":[],"x":430,"y":2180,"wires":[["1bdc1426d5758106"]]},{"id":"7ae7e01ee00a8594","type":"debug","z":"54efb553244c241f","name":"debug","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"payload","targetType":"msg","statusVal":"","statusType":"auto","x":780,"y":2180,"wires":[]},{"id":"1bdc1426d5758106","type":"jwt verify","z":"54efb553244c241f","name":"","alg":["HS256"],"jwkurl":"","secret":"whtest1234","key":"","signvar":"payload","storetoken":"payload","x":590,"y":2180,"wires":[["7ae7e01ee00a8594"]]}]

```

---

<div class="post-metadata">

### Author: ![network\_potato](https://avatars.discourse-cdn.com/v4/letter/n/59ef9b/32.png) [@network\_potato](https://discourse.nodered.org/u/network_potato)
#### Post date: [1 October 2022 17:31 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427/3 "2022-10-01T17:31:15Z")

</div>

That works, thanks! But how do I convert it to a JSON Object instead of a string?

The example flow provided is just a test webhook. The real messages contain much more information, and therefore they are now cut off because it's a string.

This is what it should look like when decoded:

> **[Webhook message structure](https://help.shipmondo.com/en/articles/4956598-webhook-message-structure)**
>
> Understand how the messages from our webhooks are structured.

---

<div class="post-metadata">

### Author: ![UnborN](https://avatars.discourse-cdn.com/v4/letter/u/4491bb/32.png) [@UnborN](https://discourse.nodered.org/u/UnborN)
#### Post date: [1 October 2022 18:13 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427/4 "2022-10-01T18:13:24Z")

</div>

You can use the JSON node to convert the string to Javascript Object

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/1/b/1b0c69d35dbfbc5e6847017e7b49600094c91cfc.png)

In your example data, because it was wrapped in two double quotes, i had to use two nodes in a row .. weird.

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/f/9/f9723d61bbd12c69d7d3f6c7d9b9e27480900189.png)

---

<div class="post-metadata">

### Author: ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [1 October 2022 19:06 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427/5 "2022-10-01T19:06:59Z")

</div>

> [@network\_potato](#):
>
> But how do I convert it to a JSON Object instead of a string?

It is already a JSON object (JSON objects are strings). I assume you mean that you want to convert from JSON to a javascript object.

[This post](https://dev.to/desoga/javascript-object-vs-json-demystified-494j) should help to clarify the difference between Javascript objects and JSON.

---

<div class="post-metadata">

### Author: ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [1 October 2022 19:10 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427/6 "2022-10-01T19:10:02Z")

</div>

> [@UnborN](#):
>
> because it was wrapped in two double quotes, i had to use two nodes in a row

The first JSON node sees a JSON string which starts and ends with quotes. The JSON spec says that `"bla bla"` is valid json and represents the string `bla bla`, so it converts it to that string (so it strips off the quotes. The second then takes the result, which is also valid JSON, and converts it to a javascript object.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [15 October 2022 19:10 UTC](https://discourse.nodered.org/t/how-to-decode-jwt/68427/7 "2022-10-15T19:10:50Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
