Version Build Status License

📚 Documentation • 🚀 Getting Started • 📃 Support Policy • 💬 Feedback

This library doesn't validate the JWT. Any well-formed JWT can be decoded from Base64URL.

Migrating from v3? Check the Migration Guide.

Documentation

API Documentation - documentation auto-generated from the code comments that explains all the available features.
- JWT
- Claim
- JWTDecodeError
Auth0 Documentation - explore our docs site and learn more about Auth0.

[!IMPORTANT] Check the Support Policy to learn when dropping Xcode, Swift, and platform versions will not be considered a breaking change.

Getting Started

Requirements

iOS 14.0+ / macOS 11.0+ / tvOS 14.0+ / watchOS 7.0+ / visionOS 1.0+
Xcode 16.x
Swift 6.0+

Installation

Swift Package Manager

Open the following menu item in Xcode:

File > Add Packages...

In the Search or Enter Package URL search box enter this URL:

https://github.com/auth0/JWTDecode.swift

Then, select the dependency rule and press Add Package.

Cocoapods

Add the following line to your Podfile:

pod 'JWTDecode', '~> 4.0'

Then, run pod install.

Carthage

Add the following line to your Cartfile:

github "auth0/JWTDecode.swift" ~> 4.0

Then, run carthage bootstrap --use-xcframeworks.

Usage

See all the available features in the API documentation ↗

[!NOTE] JWTDecode.swift is fully compatible with Swift 6's concurrency features. All public types conform to Sendable for safe usage across concurrency boundaries.

Import the framework

import JWTDecode

Decode the token

let jwt = try decode(jwt: token)

JWT parts

| Part | Property | |:-------------------|:----------------| | Header dictionary | jwt.header | | Claims in JWT body | jwt.body | | JWT signature | jwt.signature |

Registered claims

| Claim | Property | |:------------------------|:-----------------| | aud Audience | jwt.audience | | sub Subject | jwt.subject | | jti JWT ID | jwt.identifier | | iss Issuer | jwt.issuer | | nbf Not Before | jwt.notBefore | | iat Issued At | jwt.issuedAt | | exp Expiration Time | jwt.expiresAt |

Custom claims

You can retrieve a custom claim through a subscript and then attempt to convert the value to a specific type.

if let email = jwt["email"].string {
    print("Email is \(email)")
}

The supported conversions are:

var string: String?
var boolean: Bool?
var integer: Int?
var double: Double?
var date: Date?
var array: [String]?
var data: Data?

You can also decode complex claims directly to Decodable types:

struct Address: Decodable {
    let street: String
    let city: String
}

// Decode a custom claim
let address = try jwt["address"].decode(Address.self)

// With custom decoder configuration
struct User: Decodable {
    let firstName: String
    let lastName: String
}

let decoder = JSONDecoder()
decoder.keyDecodingStrategy = .convertFromSnakeCase
let user = try jwt["user_info"].decode(User.self, using: decoder)

You can easily add a convenience accessor for a custom claim in an extension.

extension JWT {
    var myClaim: String? {
        return self["my_claim"].string
    }
}

Error handling

If the JWT is malformed the decode(jwt:) function will throw a JWTDecodeError.

catch let error as JWTDecodeError {
    print(error)
}

Support Policy

This Policy defines the extent of the support for Xcode, Swift, and platform (iOS, macOS, tvOS, and watchOS) versions in JWTDecode.swift.

Xcode

The only supported versions of Xcode are those that can be currently used to submit apps to the App Store. Once a Xcode version becomes unsupported, dropping it from JWTDecode.swift will not be considered a breaking change, and will be done in a minor release.

Swift

The minimum supported Swift minor version is the one released with the oldest-supported Xcode version. Once a Swift minor becomes unsupported, dropping it from JWTDecode.swift will not be considered a breaking change, and will be done in a minor release.

Platforms

We support only the last four major versions of any platform, including the current major version.

Once a platform version becomes unsupported, dropping it from JWTDecode.swift will not be considered a breaking change, and will be done in a minor release. For example, iOS 14 will cease to be supported when iOS 18 gets released, and JWTDecode.swift will be able to drop it in a minor release.

In the case of macOS, the yearly named releases are considered a major platform version for the purposes of this Policy, regardless of the actual version numbers.

Feedback

Contributing

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

Raise an issue

To provide feedback or report a bug, please raise an issue on our issue tracker.

Vulnerability reporting

Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

<picture> <source media="(prefers-color-scheme: light)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150"> <source media="(prefers-color-scheme: dark)" srcset="https://cdn.auth0.com/website/sdks/logos/auth0_dark_mode.png" width="150"> <img alt="Auth0 Logo" src="https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png" width="150"> </picture> Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkout <a href="https://auth0.com/why-auth0">Why Auth0?</a> This project is licensed under the MIT license. See the <a href="./LICENSE"> LICENSE</a> file for more info.

JWTDecode.swift

Install / Use

README