How to Decode and Verify JWTs Locally: Native CLI & Zero-Bloat Cryptographic Validation

# Extract and decode the payload (Part 2)
JWT="your.jwt.token_here"
echo "$JWT" | cut -d'.' -f2 | awk '{l=length($0)%4; if(l==2) print $0"=="; else if(l==3) print $0"="; else print $0}' | tr '_-' '/+' | base64 -d

$JWT = "your.jwt.token_here"
$Payload = $JWT.Split('.')[1]
$Padded = $Payload.PadRight($Payload.Length + (4 - $Payload.Length % 4) % 4, '=')
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Padded.Replace('-', '+').Replace('_', '/')))

+-----------------------------+ . +-----------------------------+ . +-----------------------------+
|           HEADER            |   |           PAYLOAD           |   |          SIGNATURE          |
|  {"alg": "HS256", ...}      |   |  {"sub": "1234", ...}       |   |  HMACSHA256(Header.Payload) |
+-----------------------------+   +-----------------------------+   +-----------------------------+

Linux (GNU Coreutils pipeline):
[stdin pipe] -> [awk padding check] -> [tr stream replacement] -> [base64 streaming buffer] -> [stdout]
                     ^                      ^                          ^
                     |                      |                          |
             (4KB I/O buffer)       (In-place mutate)          (Stack frame decode)

Windows (.NET CLR String Pipeline):
[Managed Heap (UTF-16)] -> [PadRight() -> New String] -> [Replace() -> New String] -> [Byte Array Alloc] -> [UTF-8 String Alloc]

#!/usr/bin/env bash
# Native JWT Decoder using POSIX tools (sh, awk, tr, base64)

decode_jwt() {
    local jwt="$1"
    
    # Split token segments by period delimiter
    local header_b64=$(echo "$jwt" | cut -d'.' -f1)
    local payload_b64=$(echo "$jwt" | cut -d'.' -f2)
    local signature_b64=$(echo "$jwt" | cut -d'.' -f3)

    if [ -z "$header_b64" ] || [ -z "$payload_b64" ]; then
        echo "Error: Invalid JWT structure. Expected format: Header.Payload.Signature" >&2
        return 1
    fi

    # Inner function to normalize Base64Url to standard Base64 and decode
    b64url_decode() {
        local input="$1"
        local len=${#input}
        local pad=$(( (4 - (len % 4)) % 4 ))
        
        # Append base64 padding '=' characters
        local padded="$input"
        [ $pad -eq 1 ] && padded="${input}="
        [ $pad -eq 2 ] && padded="${input}=="
        [ $pad -eq 3 ] && padded="${input}==="

        # Translate '-' to '+' and '_' to '/', then decode
        echo "$padded" | tr -- '-_' '+/' | base64 -d 2>/dev/null
    }

    echo "=== HEADER ==="
    b64url_decode "$header_b64"
    echo -e "\n\n=== PAYLOAD ==="
    b64url_decode "$payload_b64"
    echo -e "\n\n=== SIGNATURE (Raw Base64Url) ==="
    echo "$signature_b64"
}

# Example usage:
# decode_jwt "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"

function ConvertFrom-Jwt {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true, Position = 0)]
        [string]$Token
    )

    $parts = $Token.Split('.')
    if ($parts.Count -lt 2) {
        Write-Error "Invalid JWT format. Must contain at least a Header and Payload separated by '.'"
        return
    }

    function Parse-Base64Url ([string]$Segment) {
        # Calculate RFC-compliant Base64 padding
        $mod4 = $Segment.Length % 4
        if ($mod4 -gt 0) {
            $Segment = $Segment.PadRight($Segment.Length + (4 - $mod4), '=')
        }
        # Translate RFC 7519 URL safe characters back to standard Base64 characters
        $base64 = $Segment.Replace('-', '+').Replace('_', '/')
        $bytes = [System.Convert]::FromBase64String($base64)
        return [System.Text.Encoding]::UTF8.GetString($bytes)
    }

    [PSCustomObject]@{
        Header    = Parse-Base64Url $parts[0]
        Payload   = Parse-Base64Url $parts[1]
        Signature = if ($parts.Count -ge 3) { $parts[2] } else { $null }
    }
}

# Example usage:
# ConvertFrom-Jwt -Token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"

+-----------------------------------------------------------------------------------+
| Node.js / Electron:                                                               |
| [JS VM Context] -> [V8 Native C++ Binding] -> [OpenSSL] -> [CPU SHA Instructions] |
+-----------------------------------------------------------------------------------+
| Native CLI (OpenSSL / .NET):                                                      |
| [Shell / PowerShell] -> [Platform Crypto API] -----------> [CPU SHA Instructions] |
+-----------------------------------------------------------------------------------+

#!/usr/bin/env bash
# Verify HS256 JWT signature using OpenSSL and native Bash

verify_jwt_hs256() {
    local jwt="$1"
    local secret="$2"

    local header=$(echo "$jwt" | cut -d'.' -f1)
    local payload=$(echo "$jwt" | cut -d'.' -f2)
    local provided_signature=$(echo "$jwt" | cut -d'.' -f3)

    # Reconstruct the HMAC signing input string (Header.Payload)
    local signing_input="${header}.${payload}"

    # Compute raw binary HMAC SHA-256 and encode to Base64Url
    local calculated_signature=$(echo -n "$signing_input" | \
        openssl dgst -sha256 -hmac "$secret" -binary | \
        openssl base64 -e | \
        tr -d '=' | tr '/+' '_-' | tr -d '\n')

    echo "Provided Signature:   $provided_signature"
    echo "Calculated Signature: $calculated_signature"

    if [ "$provided_signature" = "$calculated_signature" ]; then
        echo -e "\n\033[0;32m[+] SUCCESS: Cryptographic signature matches. Token is authentic.\033[0m"
        return 0
    else
        echo -e "\n\033[0;31m[-] ERROR: Signature mismatch! Token has been tampered with or secret is invalid.\033[0m"
        return 1
    fi
}

# Example usage:
# verify_jwt_hs256 "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" "your-256-bit-secret"

function Test-JwtSignature {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [string]$Token,
        
        [Parameter(Mandatory = $true)]
        [string]$Secret
    )

    $parts = $Token.Split('.')
    if ($parts.Count -ne 3) {
        Write-Error "A complete JWT containing Header, Payload, and Signature is required for verification."
        return
    }

    $header = $parts[0]
    $payload = $parts[1]
    $providedSignature = $parts[2]

    # Reconstruct input
    $signingInput = "$header.$payload"
    $signingInputBytes = [System.Text.Encoding]::UTF8.GetBytes($signingInput)
    $secretBytes = [System.Text.Encoding]::UTF8.GetBytes($Secret)

    # Compute HMAC SHA-256 using .NET native cryptography providers
    $hmac = New-Object System.Security.Cryptography.HMACSHA256
    $hmac.Key = $secretBytes
    $computedHashBytes = $hmac.ComputeHash($signingInputBytes)
    $hmac.Dispose()

    # Convert binary digest to Base64Url format
    $computedSignature = [System.Convert]::ToBase64String($computedHashBytes)`
        .Split('=')[0]`
        .Replace('+', '-')`
        .Replace('/', '_')

    Write-Host "Provided Signature:   $providedSignature"
    Write-Host "Calculated Signature: $computedSignature"

    # Constant-time comparison or clean equality validation
    if ($providedSignature -eq $computedSignature) {
        Write-Host "`n[+] SUCCESS: Cryptographic signature matches. Token is authentic." -ForegroundColor Green
        return $true
    } else {
        Write-Host "`n[-] ERROR: Signature mismatch! Token invalid or wrong secret provided." -ForegroundColor Red
        return $false
    }
}

# Example usage:
# Test-JwtSignature -Token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" -Secret "your-256-bit-secret"