JWT / JWS / JWE inspection

Read the token.
Trust the evidence.

jwtd decodes JSON web tokens, verifies signatures, and decrypts encrypted payloads without leaving your terminal.

Choose an install method Read the field guide

brew install webcodr/tap/jwtd

jwtd - token inspection

$ jwtd eyJhbGciOiJSUzI1NiIs...

Header:
{
  "alg": "RS256",
  "typ": "JWT"
}

Payload:
{
  "sub": "user_2048",
  "admin": true,
  "iat": 1784689200,
  "note": null
}

Signature: eyJfX2p3dGRfXyI...

01 / capabilities

One command, the full token path.

Inspect first. Add a key only when cryptographic proof or plaintext is needed.

Decode JWTs

Pretty-print exact JSON values and human-readable token timestamps.

Verify JWS

Check the cryptographic signature independently from claim expiry.

Decrypt JWE

Detect compact JWEs and reveal protected content with the supplied key.

Follow nesting

Recursively inspect JWT-inside-JWE and JWE-inside-JWE payloads.

Bring real keys

Use PEM, DER, certificates, JWK Sets, encoded material, or raw secrets.

02 / installation

Put jwtd on your path.

The suggested method follows your operating system when JavaScript is available. Every method remains below when it is not.

Homebrew Scoop Linux packages Go Archives

macOS / Linux

Homebrew formula

Installs the current release from the webcodr tap.

brew install webcodr/tap/jwtd

Windows

Scoop bucket

Add the bucket once, then install jwtd.

scoop bucket add webcodr https://github.com/webcodr/scoop-bucket
scoop install jwtd

Linux / choose package and architecture

Native packages

Download the matching release asset. Distro and CPU architecture are intentionally not guessed.

Debian / Ubuntu - amd64 Download .deb

sudo dpkg -i jwtd-linux-amd64.deb

Debian / Ubuntu - arm64 Download .deb

sudo dpkg -i jwtd-linux-arm64.deb

Fedora / RHEL / openSUSE - amd64 Download .rpm

sudo rpm -i jwtd-linux-amd64.rpm

Fedora / RHEL / openSUSE - arm64 Download .rpm

sudo rpm -i jwtd-linux-arm64.rpm

Browse all Linux package assets

Go 1.26+

Install from source

Build the latest tagged version with your Go toolchain.

go install github.com/webcodr/jwtd@latest

Linux / macOS / Windows

Release archives

Choose amd64 or arm64 for your platform, verify it, and place the binary on your path.

linux-amd64linux-arm64darwin-amd64darwin-arm64windows-amd64windows-arm64

Browse release archives

03 / usage

From readable to verified.

Tokens can arrive as an argument, through stdin, or at the interactive prompt.

Decode a JWT

Inspect the header, claims, and signature without requiring a key.

jwtd eyJhbGciOiJIUzI1NiIs...

Verify a JWS signature

A failed signature prints INVALID and exits nonzero. Claim expiry is not part of this cryptographic check.

jwtd --key /path/to/public-key.pem eyJhbGciOiJSUzI1NiIs...

Decrypt a JWE

Five-part compact tokens are detected automatically; provide the private key to reveal the payload.

jwtd --key /path/to/private-key.pem eyJhbGciOiJSU0EtT0FF...

04 / key formats

Use the key material you already have.

The --key flag and JWTD_KEY environment variable share the same format detection path.

PEMRSA, EC, Ed25519, private or public
DERPKCS#1, PKCS#8, SEC 1, PKIX
X.509Certificate public keys
JWK / JWK SetSingle keys or the first set entry
Base64Standard or URL-safe encoded material
raw:Explicit literal symmetric secrets

Explicit HMAC secret

jwtd --key raw:my-hmac-secret eyJhbGciOiJIUzI1NiIs...

05 / release security

Verify before execution.

Every archive and Linux package is covered by checksums.txt. The checksum file carries a keyless Cosign bundle tied to this repository's release workflow, and every archive ships with a Syft SPDX SBOM.

Read the exhaustive verification instructions

Verify the signed checksum file

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/webcodr/jwtd/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

Read the token.Trust the evidence.