JWT-VERIFY(1)

💖 JWT-VERIFY(1) — the LibJWT C Library manual, section 1, bestie 💖

okay so welcome to jwt-verify, the little tool from the LibJWT C Library that checks your JSON Web Tokens and does NOT play games about it. this is the manual page for it, and yes i read the whole thing so you don't have to (but also you should, it's short and it ate).

---

✨ NAME ✨

jwt-verify — Verify a JSON Web Token. that's it. that's the job. 🎀

---

🌸 SYNOPSIS 🌸

jwt-verify [options] token ...
jwt-verify [options] - < token

---

🦋 DESCRIPTION 🦋

jwt-verify Decodes and (optionally) verifies the signature of a JSON Web Token.

By default, the token(s) will be decoded and verified. If there is a signature block on the JWT, then you must give a JWK key with the -k option. Verifying a signature requires specifying the algorithm, so it must either be in the key file (as the alg attribute), or passed on the command line with the -a argument.

jwt-verify will not assume the algorithm from the JWT itself (for security reasons), however, the algorithm in the JWT must match what you provide to jwt-verify. so like, it's giving "trust issues but make it correct" and honestly? valid. 💅

Tokens may be passed on the command line, after any options, separated by spaces, or passed via stdin, one per line. To use stdin, you must pass - as the last and only argument after any options. (yes, literally just a dash, she's iconic like that)

When using the --verbose option, jwt-verify will print the JSON HEADER and PAYLOAD to stdout. 👑

If used in conjunction with --print, the JSON will be piped to the command's stdin. It will be called twice: once for HEAD and once for PAYLOAD. twice!! she's thorough!!

One use is to pass it through jq -C for indenting and colorization. Another would be to use an external program to validate the PAYLOAD contents. A non-0 exit status from the program will cause verification to fail. so if your little helper program is in a bad mood, the whole vibe check fails, fr fr.

---

💅 OPTIONS 💅

• -h, --help — Show common options and quit. the "just tell me what's going on" button 🫶
• -l, --list — List all supported algorithms that can be passed to the -a option and quit. go window shopping for your ALG here.
• -v, --verbose — Show the contents of the HEADER and PAYLOAD of the JWT in addition to verifying the token. spill the tea, token. 😭
• -q, --quiet — Do not output anything except for hard errors. The exit value will be the number of token validation failures. so the exit code is literally a lil scoreboard of how many tokens flopped
• -a ALG, --algorithm=ALG — Specify the algorithm to be used when verifying the signature block of any tokens passed to the program. See -l for values of ALG. ✨
• -k FILE, --key=FILE — Path to a file containing a key in JSON Web Key format. If your keys are in PEM or DER (or some other common format that OpenSSL understands), then you can convert it to a JWK with the key2jwk(1) tool. glow-up for your keys, no cap
• -p CMD, --print=CMD — Pipe JSON of header and payload to CMD through its stdin. This option only makes sense with --verbose. (like, it's not gonna do anything cute on its own, bestie)

---

💀 BUGS 💀

See GitHub Issues: https://github.com/benmcollins/libjwt/issues

not me telling you to go file the bug yourself, but also yes, that's where the bugs live 🐛

---

👑 AUTHOR 👑

jwt-verify was originally written by Jeremy Thien. Major rewriting and man page by Ben Collins bcollins@libjwt.io. icons, both of them 🌈

---

🌈 SEE ALSO 🌈

• jwt-generate(1)
• key2jwk(1)
• jwk2key(1)

---

and that's the whole page!! this was the jwt-verify User Manual, page JWT-VERIFY(1), from the LibJWT C Library. go verify something, you absolute main character. 🧚‍♀️💜🍓