jwt.verify() returns numeric payload claims as strings #1042

Activity

1. official-burak commented on Aug 27, 2026

   

   official-burak

   on Aug 27, 2026

   More actions

   jwt.verify() does not stringify numeric claims. The payload is JSON.stringify on sign and JSON.parse on verify, so a JSON number stays a number.

   I ran this on jsonwebtoken@9.0.3 (same major as yours):

   const jwt = require('jsonwebtoken');
   const decoded = jwt.verify(jwt.sign({ id: 67 }, 's'), 's');
   console.log(typeof decoded.id, decoded.id); // number 67

   The payload segment is {"id":67,...} with an unquoted number. @types/jsonwebtoken's JwtPayload also does not declare id, so as { id: number } is only a type assertion. It cannot turn a runtime number into a string.

   If you are actually seeing a string, id was almost certainly already a string before sign. Typical sources: HTML form fields, query params, process.env, Mongo ObjectId via .toString(), or spreading a parsed JSON body that quoted the value. Log typeof payload.id immediately before jwt.sign.

   Do not confuse id with registered string claims. sub / jti are strings by spec. iat / exp / nbf are numbers.

   If you paste the compact token (or just the middle payload segment, decoded) we can tell which of those it is.
2. Ameer77-tech commented on Oct 26, 2026

   

   Ameer77-tech

   on Oct 26, 2026

   Last edited by Ameer77-tech

   More actions

   node - v23.11.0, jsonwwebtoken@9.0.3

   const token = jwt.sign(
   { id: 67 },
   "secret"
   );
   const decoded = jwt.verify(token, "secret")
   console.log(typeof decoded.id);
   

   output:
   number

   I don't see an issue here, maybe once check for yourself