Is there a way decode the JWT without the secret? about java-jwt

[billinghamj]

+1 there should be a way of decoding without verification

[bennythomps]

@mattblang all you should need is a Base64 decoder (many available) and break apart the three sections of the JWT, decode the middle, and you'll have your JSON payload.

[kennycason]

Any chance of doing this supporting this in the JwtVerifier? I'd like to replace my Base64 checker on my end without having to have a special class for non secret jwt verification.

[shumy]

java-jwt should definitely have a phase of Header and Payload decode before Signature verification. The issuer is useful to search for the public key.

Although there are Base64 decoders that we can use, java-jwt will already decode, avoiding a redundant decode.

[billinghamj]

@arcseldon Why have you closed this?

[hzalaz]

We are planning on writing a library specifically for Android that only decodes the token. We closed the issue since it's already in our backlog along a rewrite of this library