How to verify an ES256 JWT in Node.js

1import { createPublicKey, verify } from "node:crypto";
2 
3function verifyEs256(token, publicKeyPem) {
4  const [header, payload, signature] = token.split(".");
5 
6  const { alg } = JSON.parse(Buffer.from(header, "base64url").toString());
7  if (alg !== "ES256") throw new Error(`expected ES256, got ${alg}`);
8 
9  const ok = verify(
10    "sha256",
11    Buffer.from(`${header}.${payload}`),        // signed bytes: the ASCII text
12    { key: createPublicKey(publicKeyPem), dsaEncoding: "ieee-p1363" },
13    Buffer.from(signature, "base64url"),          // JWS sig: raw r‖s, 64 bytes
14  );
15  if (!ok) throw new Error("invalid signature");
16 
17  const claims = JSON.parse(Buffer.from(payload, "base64url").toString());
18  if (claims.exp && claims.exp < Date.now() / 1000) throw new Error("token expired");
19  return claims;
20}

How it works

1. Pin the algorithm first: read alg from the header and require ES256. Never let the token choose the algorithm for you.
2. The signature covers the base64url *text* header.payload — sign-input is those ASCII bytes, not the decoded JSON.
3. dsaEncoding: "ieee-p1363" makes verify accept the 64-byte raw signature directly — no DER conversion step.
4. Node's Buffer.from(str, "base64url") handles the unpadded base64url encoding JWS mandates.

Gotchas

• Omitting the alg check invites algorithm-confusion: a token stamped HS256 and "verified" with the public key as an HMAC secret passes some naive implementations. Pin ES256 and reject everything else.
• Without dsaEncoding the verification always fails — node defaults to DER, and no valid JWT carries a DER signature.
• Signature validity is not token validity: exp, nbf, iss and aud checks are your job (the snippet shows exp only).

Related recipes

• How to verify an ECDSA signature in Node.js
• How to convert an ECDSA signature between DER and raw in Node.js
• How to verify an ES256 JWT in WebCrypto