Skip to content

Instantly share code, notes, and snippets.

@davidchambers

davidchambers/decode-jwt.sh

Created August 29, 2025 10:20
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save davidchambers/b3ea073bd8e708eeda4d854ba9cb8780 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save davidchambers/b3ea073bd8e708eeda4d854ba9cb8780 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
decode-jwt.sh
#!/usr/bin/env bash
set -o nounset
# JSON Web Tokens use RFC 4648 § 5 (https://www.rfc-editor.org/rfc/rfc4648#section-5).
# This "base64url" encoding differs from "base64" in a few small ways, handled below.
curl --silent --request POST --url "$URL" \
--data-urlencode grant_type=client_credentials \
--data-urlencode client_id="$CLIENT_ID" \
--data-urlencode client_secret="$CLIENT_SECRET" |
jq --raw-output .access_token |
cut -d . -f 2 | # header.payload.signature -> payload
tr - + | # base64url -> base64
tr _ / | # base64url -> base64
awk '{ printf "%-*s", length($0) + (4 - length($0) % 4) % 4, $0 }' | tr ' ' = | # base64url -> base64 (padding)
base64 --decode | # base64 -> JSON
jq
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment