diff --git a/AGENTS.md b/AGENTS.md
index 8ebe883..875dfdd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,9 +16,9 @@ All functionality lives in package `main`, split across six source files:
 - `headerKID()` - Extracts the token's `kid` header (or `""`) so JWK Set verification/decryption selects the key the token names
 - `printKeyInterpretation()` - Notes on stderr how a key argument was read when it was not read as a file, so precedence-based detection cannot silently take a value the user meant one way and use it another; adds the process-list exposure warning for `--key` values, which `JWTD_KEY` does not carry (`/proc/<pid>/cmdline` is world-readable, `/proc/<pid>/environ` is owner-only). Diagnostics go to stderr so stdout stays parseable
 - `readInteractive()` - Prompts for a token interactively using `chzyer/readline`
-- `decodeAndPrint()` - Parses the JWT with `golang-jwt/jwt` (`ParseUnverified`) and orchestrates output; verifies the signature when a key is provided
-- `parseUnverifiedJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data
-- `verifyJWTSignature()` / `verifySignature()` - `verifyJWTSignature` does the cryptographic check without printing, with `jwt.WithoutClaimsValidation()` so the result reflects only the signature, not expiry; it returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unparseable token/unusable key). `verifySignature` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero; the `--json` path reuses the same core
+- `decodeAndPrint()` / `printParsedJWT()` - `decodeAndPrint` parses the JWT with `golang-jwt/jwt` (`ParseUnverified`) and hands the result to `printParsedJWT`, which orchestrates output and verifies the signature when a key is provided. `printParsedJWT` runs `formatTimestamps` on a `maps.Clone` of the claims, so the display rewrite never touches the authoritative parse and the same `parsedJWT` can still be validated
+- `parsedJWT` / `parseUnverifiedJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data. `parseUnverifiedJWT` returns a `parsedJWT` (the raw string, token, segments, and claims) that is threaded through the decode, signature, and claim steps, so one run parses the token once instead of once per step
+- `verifyJWTSignature()` / `printSignatureVerdict()` - `verifyJWTSignature` takes a `parsedJWT` and does the cryptographic check without printing, with `jwt.WithoutClaimsValidation()` so the result reflects only the signature, not expiry; it returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unusable key). `printSignatureVerdict` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero. The `--json` path reuses the same core. Production code always holds a `parsedJWT` at this point, so there is no string-taking wrapper in the package; the tests keep one (`verifySignature` in `helpers_test.go`) for the cases that start from a compact string
 - `publicKeyForVerification()` - Extracts the public key from RSA/ECDSA/Ed25519 private keys
 
 ### `jsonout.go` - Machine-readable `--json` output
@@ -30,21 +30,21 @@ All functionality lives in package `main`, split across six source files:
 
 - `claimChecks` / `requested()` - Holds the `--verify-claims`, `--aud`, and `--iss` flag values. The zero value requests nothing, so the default stays decode-only and the exit code keeps reflecting the signature alone; `requested()` treats an expected audience or issuer as implying validation, so those flags work without also passing `--verify-claims`
 - `validateClaimsSet()` - Runs the requested RFC 7519 checks against the already-parsed claims via `jwt.NewValidator` with `jwt.WithTimeFunc(timeNow)` (so the verdict shares the display clock and is deterministic under `pinTime`), returning `valid` plus a reason. Temporal claims (`exp`, `nbf`) that are present are always checked; an expected `aud`/`iss` is additionally required to be present and match. A missing `exp` is not treated as expired. No signature verification happens here — the human and `--json` paths share this core
-- `verifyClaims()` / `claimReason()` - `verifyClaims` parses the token, calls the core, and renders `Claims: VALID`/`INVALID` with the reason, returning the `errInvalidClaims` sentinel on failure (and a hard error on an unparseable token). `claimReason` flattens the validator's newline-joined multi-error onto one `; `-separated line so the dim reason and wrapped error stay readable
+- `verifyClaims()` / `printClaimsVerdict()` / `claimReason()` - `printClaimsVerdict` runs the core against already-parsed claims and renders `Claims: VALID`/`INVALID` with the reason, returning the `errInvalidClaims` sentinel on failure; it must be given the raw parse, not the display copy `formatTimestamps` rewrites. `verifyClaims` is the wrapper that parses the token first (and returns a hard error on an unparseable one). `claimReason` flattens the validator's newline-joined multi-error onto one `; `-separated line so the dim reason and wrapped error stay readable
 
 **Claim validation is display-and-exit-code only, and deliberately separate from signature verification.** It performs no cryptography and runs whether or not a key is given, so `--verify-claims` on an unverified token still reports expiry — the two verdicts (`Signature:` and `Claims:`) are shown independently and either failing exits nonzero. This keeps the pre-existing invariant that a bare decode never fails on expiry intact: nothing validates claims unless a claim flag is passed.
 
 ### `jwe.go` - JWE parsing and decryption
 
-- `isJWE()` - Detects JWE compact serialization (5 dot-separated parts vs. 3 for a JWT)
+- `isJWE()` / `isJWT()` - Detect JWE (5 dot-separated parts) and JWS/JWT (3 parts) compact serialization. Every token-shape dispatch goes through one of these two, so the shape rules are not restated inline
 - `decodeAndPrintJWE()` / `jweProtectedHeaderMap()` - Parse a JWE with `go-jose` and decode every field in the compact protected header for display; without a key print encrypted part metadata, with a key decrypt and print the payload
-- `printEncryptedParts()` / `partSize()` - Encrypted part metadata shown when no key is provided
+- `jweEncryptedParts()` / `printEncryptedParts()` / `partSize()` - Encrypted part metadata shown when no key is provided. `jweEncryptedParts` splits the compact serialization into its five segments for both the human and `--json` paths; `partSize` renders `base64URLLen`'s count (or its `-1`) as display text, so measuring and formatting are not implemented twice
 
 ### `keys.go` - Key loading and format detection
 
-- `loadKey()` / `loadKeyForKID()` / `parseKeyData()` / `parseDERKey()` / `parseJWK()` - Resolve `raw:<secret>` and `hmac:<file>`, then an existing file path, then base64/base64url; parse loaded data as JWK/JWK Set, PEM, or DER (PKCS#1/PKCS#8/SEC 1/PKIX) keys and X.509 certificates, and error on anything else; trim trailing newlines only for ASCII `hmac:` files limited to printable bytes plus tab/CR/LF, while UTF-8/non-ASCII and other binary files remain byte-exact. `loadKeyForKID` threads the token's `kid` so a JWK Set selects the matching entry (`loadKey` is the `kid=""` wrapper); a `kid` that matches nothing returns the `errKIDNotFound` sentinel, which short-circuits the base64/unsupported-format fallbacks so a JWK Set miss fails closed with a clear message instead of degrading into other key material
+- `loadKey()` / `loadKeyForKID()` / `parseKeyData()` / `parseAnyDER()` / `parseDERKey()` / `parseJWK()` - Resolve `raw:<secret>` and `hmac:<file>`, then an existing file path, then base64/base64url; parse loaded data as JWK/JWK Set, PEM, or DER (PKCS#1/PKCS#8/SEC 1/PKIX) keys and X.509 certificates, and error on anything else. `parseAnyDER` holds the one list of understood DER encodings, used both for raw DER and as `parseDERKey`'s fallback for an unrecognized PEM block type, so a format cannot be added to one and missed by the other. `parseKeyData` only detects formats: it never phrases a rejection, because `unsupportedKeyError` is the single place that knows the user-facing subject and the symmetric-form hint. Trailing newlines are trimmed only for ASCII `hmac:` files limited to printable bytes plus tab/CR/LF, while UTF-8/non-ASCII and other binary files remain byte-exact. `loadKeyForKID` threads the token's `kid` so a JWK Set selects the matching entry (`loadKey` is the `kid=""` wrapper); a `kid` that matches nothing returns the `errKIDNotFound` sentinel, which short-circuits the base64/unsupported-format fallbacks so a JWK Set miss fails closed with a clear message instead of degrading into other key material
 - `unsupportedKeyError()` - Explains a rejection and names the explicit symmetric form to use, substituting the user's own path so the fix is copy-pasteable; SSH keys get a conversion hint instead
-- `classifyKeyArg()` - Reports which reading `loadKey` will apply (`raw:` literal, `hmac:` secret file, existing file, base64, or unusable), mirroring its precedence so the CLI hint cannot drift from actual behavior; uses `Stat` rather than a read, so classifying never consumes the key source
+- `classifyKeyArg()` / `loadSymmetricKeyFile()` / `loadKeyFile()` / `loadInlineKey()` - `classifyKeyArg` decides which reading applies (`raw:` literal, `hmac:` secret file, existing file, base64, or unusable) and `loadKeyForKID` switches on it to call the matching loader, so the precedence exists once: the reading the CLI hint reports is by construction the reading that happens, not a mirror of it. It uses `Stat` rather than a read, so classifying never consumes the key source; a consequence is that an existing but unreadable file now reports the read error instead of falling through to a base64 attempt on its path
 - `decodeBase64Key()` / `symmetricKey()` - Decode whitespace-tolerant base64/base64url key material (applied to text key files as well as inline arguments, so the same bytes mean the same key either way) and gate symmetric secrets, rejecting empty key material
 - `isTextKey()` / `isSSHPublicKey()` / `isSSHKeyType()` / `sshBlobHasType()` - Distinguish ASCII text from binary for newline trimming, and detect SSH public keys for the targeted error
 
@@ -57,7 +57,7 @@ Removing the fallback deleted the heuristics that existed only to decide it (`is
 - `printDecryptedPayload()` / `escapeTerminalText()` / `escapeFormattedJSONControls()` - Recursively decode nested JWTs/JWEs and pretty-print JSON objects or arrays; raw plaintext escapes C0 controls except newline/tab, DEL, C1 controls, invalid UTF-8 bytes, and targeted bidi controls, while formatted JSON sanitizes C1, DEL, and the same targeted bidi controls
 - `formatTimestamps()` / `timestampStatus()` / `humanizeDuration()` - Convert exact `iat`, `exp`, `nbf` Unix numeric values, including fractions, to RFC3339 strings (original value shown in parentheses); `exp` is annotated with the time remaining or elapsed (`expires in 14m` / `expired 2h ago`) and a future `nbf` with `not yet valid, in 5m` (an already-valid `nbf` gets no note). `humanizeDuration` renders the largest whole unit (s/m/h/d), truncating toward zero for deterministic output. This is display-only and never affects verification or the exit code; `timeNow` is a package variable so the annotations are testable. The `--json` path skips this entirely and keeps raw numeric claims
 - `newFormatter()` - Creates a `go-prettyjson` formatter with the project color scheme
-- `printSection()` / `printSignature()` - Formatted output using `fatih/color`
+- `printSection()` / `printSignature()` / `printVerdict()` - Formatted output using `fatih/color`. `printSection` takes any JSON-marshalable value, so objects and arrays share one path; `printVerdict` renders the `<label>: VALID`/`INVALID` line with its dim reason, shared by the independent signature and claim verdicts so they cannot drift apart visually
 
 ### Release packaging
 
diff --git a/claims.go b/claims.go
index 1e8fabc..744abec 100644
--- a/claims.go
+++ b/claims.go
@@ -6,7 +6,6 @@ import (
 	"io"
 	"strings"
 
-	"github.com/fatih/color"
 	"github.com/golang-jwt/jwt/v5"
 )
 
@@ -59,23 +58,27 @@ func validateClaimsSet(claims jwt.MapClaims, c claimChecks) (bool, error) {
 // a hard error instead. Claim validation is independent of the signature: it
 // runs with or without a key.
 func verifyClaims(w io.Writer, tokenStr string, c claimChecks) error {
-	_, _, claims, err := parseUnverifiedJWT(tokenStr)
+	p, err := parseUnverifiedJWT(tokenStr)
 	if err != nil {
 		return err
 	}
+	return printClaimsVerdict(w, p.claims, c)
+}
 
+// printClaimsVerdict runs the requested checks against already-parsed claims
+// and renders the verdict, so a caller that has parsed the token (the human
+// decode path) does not parse it again just to validate it. The claims must be
+// the raw parse, not the display copy formatTimestamps rewrites.
+func printClaimsVerdict(w io.Writer, claims jwt.MapClaims, c claimChecks) error {
 	valid, reason := validateClaimsSet(claims, c)
 	if !valid {
-		if _, werr := color.New(color.FgRed, color.Bold).Fprintln(w, "Claims: INVALID"); werr != nil {
-			return werr
-		}
-		if _, werr := dimColor.Fprintf(w, "  %s\n", claimReason(reason)); werr != nil {
+		text := claimReason(reason)
+		if werr := printVerdict(w, "Claims", false, text); werr != nil {
 			return werr
 		}
-		return fmt.Errorf("%w: %s", errInvalidClaims, claimReason(reason))
+		return fmt.Errorf("%w: %s", errInvalidClaims, text)
 	}
-	_, werr := color.New(color.FgGreen, color.Bold).Fprintln(w, "Claims: VALID")
-	return werr
+	return printVerdict(w, "Claims", true, "")
 }
 
 // claimReason flattens a validation error onto a single line. The jwt validator
diff --git a/claims_test.go b/claims_test.go
index 34d8dd1..204ef15 100644
--- a/claims_test.go
+++ b/claims_test.go
@@ -130,7 +130,7 @@ func TestValidateClaimsSet(t *testing.T) {
 
 func TestVerifyClaims_ValidPrintsAndReturnsNil(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 
 	var buf bytes.Buffer
 	if err := verifyClaims(&buf, token, claimChecks{verify: true}); err != nil {
@@ -143,7 +143,7 @@ func TestVerifyClaims_ValidPrintsAndReturnsNil(t *testing.T) {
 
 func TestVerifyClaims_InvalidReturnsSentinelAndReason(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	err := verifyClaims(&buf, token, claimChecks{verify: true})
@@ -185,7 +185,7 @@ func TestClaimReason_FlattensJoinedErrors(t *testing.T) {
 
 func TestDecodeJWTHuman_NoClaimSectionWhenNotRequested(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	if err := decodeJWTHuman(&buf, token, "", claimChecks{}); err != nil {
@@ -198,7 +198,7 @@ func TestDecodeJWTHuman_NoClaimSectionWhenNotRequested(t *testing.T) {
 
 func TestDecodeJWTHuman_ClaimsSectionAfterSignature(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 
 	var buf bytes.Buffer
 	if err := decodeJWTHuman(&buf, token, "raw:secret", claimChecks{verify: true}); err != nil {
@@ -217,7 +217,7 @@ func TestDecodeJWTHuman_ClaimsSectionAfterSignature(t *testing.T) {
 
 func TestDecodeJWTHuman_ValidSignatureInvalidClaims(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	err := decodeJWTHuman(&buf, token, "raw:secret", claimChecks{verify: true})
@@ -232,7 +232,7 @@ func TestDecodeJWTHuman_ValidSignatureInvalidClaims(t *testing.T) {
 
 func TestDecodeJWTHuman_InvalidSignatureStillShowsClaims(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 
 	var buf bytes.Buffer
 	// Wrong key: the signature is invalid, but the claims are still live.
@@ -252,7 +252,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 	pinTime(t, 1000)
 
 	t.Run("valid", func(t *testing.T) {
-		token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+		token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 		var buf bytes.Buffer
 		if err := decodeJWTJSON(&buf, token, "", claimChecks{verify: true}); err != nil {
 			t.Fatalf("unexpected error: %v", err)
@@ -263,7 +263,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 	})
 
 	t.Run("expired emits json then sentinel", func(t *testing.T) {
-		token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+		token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 		var buf bytes.Buffer
 		err := decodeJWTJSON(&buf, token, "", claimChecks{verify: true})
 		if !errors.Is(err, errInvalidClaims) {
@@ -275,7 +275,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 	})
 
 	t.Run("not requested omits field", func(t *testing.T) {
-		token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+		token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 		var buf bytes.Buffer
 		if err := decodeJWTJSON(&buf, token, "", claimChecks{}); err != nil {
 			t.Fatalf("unexpected error: %v", err)
@@ -289,7 +289,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 func TestDecodeJWTJSON_SignatureTakesPrecedenceOverClaims(t *testing.T) {
 	pinTime(t, 1000)
 	// Expired claims and a wrong key: both checks fail.
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	err := decodeJWTJSON(&buf, token, "raw:wrong-secret", claimChecks{verify: true})
diff --git a/helpers_test.go b/helpers_test.go
index 5106089..feeb218 100644
--- a/helpers_test.go
+++ b/helpers_test.go
@@ -11,12 +11,16 @@ import (
 	"crypto/x509/pkix"
 	"encoding/base64"
 	"encoding/binary"
+	"encoding/json"
 	"encoding/pem"
 	"fmt"
+	"io"
 	"math/big"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -76,8 +80,28 @@ func assertEscapedControlRunes(t *testing.T, output []byte, controls ...rune) {
 
 // --- JWE helpers -------------------------------------------------------------
 
-// generateRSAKey creates a fresh RSA key pair for testing.
+// sharedRSAKey generates the suite's default RSA key once. RSA generation
+// dominates the suite's runtime and the key is only ever read, so tests that
+// need "an RSA key" share this one.
+var sharedRSAKey = sync.OnceValues(func() (*rsa.PrivateKey, error) {
+	return rsa.GenerateKey(rand.Reader, 2048)
+})
+
+// generateRSAKey returns the shared RSA key pair. Use generateDistinctRSAKey
+// when a test needs a second key that must differ from this one, such as the
+// wrong-key cases.
 func generateRSAKey(t *testing.T) *rsa.PrivateKey {
+	t.Helper()
+	key, err := sharedRSAKey()
+	if err != nil {
+		t.Fatalf("generating RSA key: %v", err)
+	}
+	return key
+}
+
+// generateDistinctRSAKey creates a fresh RSA key pair that differs from the
+// shared one, for tests that need two keys at once.
+func generateDistinctRSAKey(t *testing.T) *rsa.PrivateKey {
 	t.Helper()
 	key, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
@@ -108,21 +132,61 @@ func encryptJWE(t *testing.T, key *rsa.PrivateKey, plaintext []byte) string {
 	return compact
 }
 
-// writeKeyFile writes an RSA private key to a temp PEM file and returns the path.
-func writeKeyFile(t *testing.T, key *rsa.PrivateKey) string {
+// writeTempFile writes data to a file of the given name in a fresh temp
+// directory and returns its path. Every helper that produces a key, key
+// material, or certificate file goes through it, so temp-file handling and its
+// failure message exist once.
+func writeTempFile(t *testing.T, name string, data []byte) string {
 	t.Helper()
-	der := x509.MarshalPKCS1PrivateKey(key)
-	block := &pem.Block{Type: "RSA PRIVATE KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-key.pem")
-	f, err := os.Create(path)
+	path := filepath.Join(t.TempDir(), name)
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		t.Fatalf("writing %s: %v", name, err)
+	}
+	return path
+}
+
+// writePEMFile PEM-encodes der under the given block type and writes it out.
+func writePEMFile(t *testing.T, name, blockType string, der []byte) string {
+	t.Helper()
+	return writeTempFile(t, name, pem.EncodeToMemory(&pem.Block{Type: blockType, Bytes: der}))
+}
+
+// writePublicKeyFile writes any public key as a PKIX "PUBLIC KEY" PEM file.
+// MarshalPKIXPublicKey handles RSA, ECDSA, and Ed25519 alike, so the key types
+// do not each need their own writer.
+func writePublicKeyFile(t *testing.T, name string, pub any) string {
+	t.Helper()
+	der, err := x509.MarshalPKIXPublicKey(pub)
 	if err != nil {
-		t.Fatalf("creating key file: %v", err)
+		t.Fatalf("marshaling public key: %v", err)
 	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
+	return writePEMFile(t, name, "PUBLIC KEY", der)
+}
+
+// writeJWKFile marshals a single JWK and writes it to a temp file.
+func writeJWKFile(t *testing.T, name string, key any, kid string) string {
+	t.Helper()
+	data, err := json.Marshal(jose.JSONWebKey{Key: key, KeyID: kid})
+	if err != nil {
+		t.Fatalf("marshaling JWK: %v", err)
 	}
-	return path
+	return writeTempFile(t, name, data)
+}
+
+// writeJWKSetFile marshals a JWK Set and writes it to a temp file.
+func writeJWKSetFile(t *testing.T, name string, keys ...jose.JSONWebKey) string {
+	t.Helper()
+	data, err := json.Marshal(jose.JSONWebKeySet{Keys: keys})
+	if err != nil {
+		t.Fatalf("marshaling JWK Set: %v", err)
+	}
+	return writeTempFile(t, name, data)
+}
+
+// writeKeyFile writes an RSA private key to a temp PEM file and returns the path.
+func writeKeyFile(t *testing.T, key *rsa.PrivateKey) string {
+	t.Helper()
+	return writePEMFile(t, "test-key.pem", "RSA PRIVATE KEY", x509.MarshalPKCS1PrivateKey(key))
 }
 
 // generateECKey creates a fresh ECDSA P-256 key pair for testing.
@@ -142,17 +206,7 @@ func writeECKeyFile(t *testing.T, key *ecdsa.PrivateKey) string {
 	if err != nil {
 		t.Fatalf("marshaling EC key: %v", err)
 	}
-	block := &pem.Block{Type: "EC PRIVATE KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-ec-key.pem")
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatalf("creating key file: %v", err)
-	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePEMFile(t, "test-ec-key.pem", "EC PRIVATE KEY", der)
 }
 
 // symmetricKeyArg writes symmetric key bytes to a temp file and returns the
@@ -166,11 +220,7 @@ func symmetricKeyArg(t *testing.T, key []byte) string {
 // writeSymmetricKeyFile writes raw symmetric key bytes to a temp file and returns the path.
 func writeSymmetricKeyFile(t *testing.T, key []byte) string {
 	t.Helper()
-	path := filepath.Join(t.TempDir(), "test-sym-key.bin")
-	if err := os.WriteFile(path, key, 0600); err != nil {
-		t.Fatalf("writing symmetric key file: %v", err)
-	}
-	return path
+	return writeTempFile(t, "test-sym-key.bin", key)
 }
 
 // encryptJWEGeneric creates a JWE compact serialization with the given algorithms and key.
@@ -225,41 +275,13 @@ func symmetricKeyForEnc(t *testing.T, enc jose.ContentEncryption) []byte {
 // writeRSAPublicKeyFile writes an RSA public key to a temp PEM file and returns the path.
 func writeRSAPublicKeyFile(t *testing.T, key *rsa.PublicKey) string {
 	t.Helper()
-	der, err := x509.MarshalPKIXPublicKey(key)
-	if err != nil {
-		t.Fatalf("marshaling RSA public key: %v", err)
-	}
-	block := &pem.Block{Type: "PUBLIC KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-rsa-pub.pem")
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatalf("creating key file: %v", err)
-	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePublicKeyFile(t, "test-rsa-pub.pem", key)
 }
 
 // writeECPublicKeyFile writes an ECDSA public key to a temp PEM file and returns the path.
 func writeECPublicKeyFile(t *testing.T, key *ecdsa.PublicKey) string {
 	t.Helper()
-	der, err := x509.MarshalPKIXPublicKey(key)
-	if err != nil {
-		t.Fatalf("marshaling EC public key: %v", err)
-	}
-	block := &pem.Block{Type: "PUBLIC KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-ec-pub.pem")
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatalf("creating key file: %v", err)
-	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePublicKeyFile(t, "test-ec-pub.pem", key)
 }
 
 func writeRSACertificateFiles(t *testing.T, key *rsa.PrivateKey) (pemPath, derPath string, pemBytes []byte) {
@@ -288,6 +310,72 @@ func writeRSACertificateFiles(t *testing.T, key *rsa.PrivateKey) (pemPath, derPa
 	return pemPath, derPath, pemBytes
 }
 
+// --- JWE algorithm-coverage assertions ---------------------------------------
+
+// assertOutputContains checks that every wanted substring appears in the
+// color-stripped output. All misses are collected and reported together, so a
+// regression that drops a whole section names every value it took with it
+// without repeating the output per miss.
+func assertOutputContains(t *testing.T, out string, wants ...string) {
+	t.Helper()
+	plain := stripANSI(out)
+	var missing []string
+	for _, want := range wants {
+		if !strings.Contains(plain, want) {
+			missing = append(missing, strconv.Quote(want))
+		}
+	}
+	if len(missing) > 0 {
+		t.Errorf("output missing %s:\n%s", strings.Join(missing, ", "), plain)
+	}
+}
+
+// assertJWEHeaderOnly decodes a JWE without a key and asserts the header-only
+// rendering: the protected header, the encrypted-part metadata, and the
+// algorithm names the header is expected to carry.
+func assertJWEHeaderOnly(t *testing.T, token string, wants ...string) {
+	t.Helper()
+	var buf bytes.Buffer
+	if err := decodeAndPrintJWE(&buf, token, ""); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	assertOutputContains(t, buf.String(), append([]string{"Protected Header", "Encrypted Content"}, wants...)...)
+}
+
+// assertJWEDecrypts decodes a JWE with the given key argument and asserts the
+// decrypted payload section carries the expected values.
+func assertJWEDecrypts(t *testing.T, token, keyArg string, wants ...string) {
+	t.Helper()
+	var buf bytes.Buffer
+	if err := decodeAndPrintJWE(&buf, token, keyArg); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	assertOutputContains(t, buf.String(), append([]string{"Decrypted Payload"}, wants...)...)
+}
+
+// randomSymmetricKey returns size random bytes for the AES key-wrapping
+// algorithms, whose key length is fixed by the algorithm rather than derived
+// from the content encryption (that is symmetricKeyForEnc's job).
+func randomSymmetricKey(t *testing.T, size int) []byte {
+	t.Helper()
+	key := make([]byte, size)
+	if _, err := rand.Read(key); err != nil {
+		t.Fatalf("generating symmetric key: %v", err)
+	}
+	return key
+}
+
+// verifySignature parses a token and renders its signature verdict. Production
+// code always has a parsedJWT in hand and calls printSignatureVerdict directly;
+// this wrapper exists so the signature tests can work from a compact string.
+func verifySignature(w io.Writer, tokenStr, keyStr string) error {
+	p, err := parseUnverifiedJWT(tokenStr)
+	if err != nil {
+		return fmt.Errorf("signature verification: %w", err)
+	}
+	return printSignatureVerdict(w, p, keyStr)
+}
+
 // --- JWS signature verification -----------------------------------------------
 
 // signJWT creates a signed JWT with the given claims and RSA private key.
@@ -301,7 +389,10 @@ func signJWT(t *testing.T, key *rsa.PrivateKey, claims jwt.MapClaims) string {
 	return signed
 }
 
-// signJWTWithHMAC creates a signed JWT using HMAC-SHA256 with the given symmetric key.
+// signJWTWithHMAC creates a signed JWT using HMAC-SHA256 with the given
+// symmetric key. It also stands in for an attacker who knows the bytes of a
+// published key file, in the tests that assert such material is never accepted
+// as an HMAC secret.
 func signJWTWithHMAC(t *testing.T, key []byte, claims jwt.MapClaims) string {
 	t.Helper()
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
@@ -343,12 +434,7 @@ func writeEd25519KeyFile(t *testing.T, key ed25519.PrivateKey) string {
 	if err != nil {
 		t.Fatalf("marshaling Ed25519 key: %v", err)
 	}
-	block := &pem.Block{Type: "PRIVATE KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-ed25519-key.pem")
-	if err := os.WriteFile(path, pem.EncodeToMemory(block), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePEMFile(t, "test-ed25519-key.pem", "PRIVATE KEY", der)
 }
 
 // signJWTWithEd25519 creates a signed JWT using Ed25519 with the given private key.
@@ -381,22 +467,7 @@ func sshEd25519PublicKeyLine(pub ed25519.PublicKey, comment string) string {
 
 func writeTextKeyFile(t *testing.T, name, contents string) string {
 	t.Helper()
-	path := filepath.Join(t.TempDir(), name)
-	if err := os.WriteFile(path, []byte(contents), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
-}
-
-// signHS256 signs a token with an HMAC secret, standing in for an attacker who
-// knows the bytes of a published key file.
-func signHS256(t *testing.T, secret []byte, claims jwt.MapClaims) string {
-	t.Helper()
-	token, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(secret)
-	if err != nil {
-		t.Fatalf("signing HS256 token: %v", err)
-	}
-	return token
+	return writeTempFile(t, name, []byte(contents))
 }
 
 func signJWTWithEd25519(t *testing.T, key ed25519.PrivateKey, claims jwt.MapClaims) string {
@@ -408,3 +479,28 @@ func signJWTWithEd25519(t *testing.T, key ed25519.PrivateKey, claims jwt.MapClai
 	}
 	return signed
 }
+
+// pinTime fixes timeNow for the duration of a test so the expired /
+// not-yet-valid annotations are deterministic regardless of the wall clock.
+func pinTime(t *testing.T, unix int64) {
+	t.Helper()
+	prev := timeNow
+	timeNow = func() time.Time { return time.Unix(unix, 0) }
+	t.Cleanup(func() { timeNow = prev })
+}
+
+// decodeJWTJSONMap runs decodeJWTJSON and returns the parsed object plus the
+// error, so tests can assert on both the shape and the exit-driving error.
+func decodeJWTJSONMap(t *testing.T, token, key string) (map[string]any, error) {
+	t.Helper()
+	var buf bytes.Buffer
+	err := decodeJWTJSON(&buf, token, key, claimChecks{})
+
+	var out map[string]any
+	dec := json.NewDecoder(bytes.NewReader(buf.Bytes()))
+	dec.UseNumber()
+	if derr := dec.Decode(&out); derr != nil {
+		t.Fatalf("output is not valid JSON: %v\n%s", derr, buf.String())
+	}
+	return out, err
+}
diff --git a/jsonout.go b/jsonout.go
index a9c35ab..7a55a69 100644
--- a/jsonout.go
+++ b/jsonout.go
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"strings"
 
 	"github.com/go-jose/go-jose/v4"
 )
@@ -45,20 +44,20 @@ type jweEncrypted struct {
 // so the exit code matches the human path; the signature verdict takes
 // precedence when both fail, though either way the exit is nonzero.
 func decodeJWTJSON(w io.Writer, tokenStr, keyStr string, checks claimChecks) error {
-	token, parts, claims, err := parseUnverifiedJWT(tokenStr)
+	p, err := parseUnverifiedJWT(tokenStr)
 	if err != nil {
 		return err
 	}
 
 	out := jwtJSON{
-		Header:    token.Header,
-		Payload:   map[string]any(claims),
-		Signature: parts[2],
+		Header:    p.token.Header,
+		Payload:   map[string]any(p.claims),
+		Signature: p.parts[2],
 	}
 
 	var invalid error
 	if keyStr != "" {
-		valid, reason, verr := verifyJWTSignature(tokenStr, keyStr)
+		valid, reason, verr := verifyJWTSignature(p, keyStr)
 		if verr != nil {
 			return fmt.Errorf("signature verification: %w", verr)
 		}
@@ -69,7 +68,7 @@ func decodeJWTJSON(w io.Writer, tokenStr, keyStr string, checks claimChecks) err
 	}
 
 	if checks.requested() {
-		valid, reason := validateClaimsSet(claims, checks)
+		valid, reason := validateClaimsSet(p.claims, checks)
 		out.ClaimsValid = &valid
 		if !valid && invalid == nil {
 			invalid = fmt.Errorf("%w: %s", errInvalidClaims, claimReason(reason))
@@ -97,8 +96,7 @@ func decodeJWEJSON(w io.Writer, tokenStr, keyStr string) error {
 	out := jweJSON{ProtectedHeader: header}
 
 	if keyStr == "" {
-		parts := strings.SplitN(tokenStr, ".", 5)
-		if len(parts) == 5 {
+		if parts, ok := jweEncryptedParts(tokenStr); ok {
 			out.Encrypted = &jweEncrypted{
 				EncryptedKeyBytes: base64URLLen(parts[1]),
 				IVBytes:           base64URLLen(parts[2]),
diff --git a/jsonout_test.go b/jsonout_test.go
index 449b2a9..265912a 100644
--- a/jsonout_test.go
+++ b/jsonout_test.go
@@ -11,22 +11,6 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 )
 
-// decodeJWTJSONMap runs decodeJWTJSON and returns the parsed object plus the
-// error, so tests can assert on both the shape and the exit-driving error.
-func decodeJWTJSONMap(t *testing.T, token, key string) (map[string]any, error) {
-	t.Helper()
-	var buf bytes.Buffer
-	err := decodeJWTJSON(&buf, token, key, claimChecks{})
-
-	var out map[string]any
-	dec := json.NewDecoder(bytes.NewReader(buf.Bytes()))
-	dec.UseNumber()
-	if derr := dec.Decode(&out); derr != nil {
-		t.Fatalf("output is not valid JSON: %v\n%s", derr, buf.String())
-	}
-	return out, err
-}
-
 func TestDecodeJWTJSON_NoKeyOmitsSignatureValid(t *testing.T) {
 	token := makeJWT(`{"alg":"HS256"}`, `{"sub":"abc","exp":1516239022}`, "sig")
 
@@ -63,7 +47,7 @@ func TestDecodeJWTJSON_PreservesLargeIntegerExactly(t *testing.T) {
 
 func TestDecodeJWTJSON_ValidSignature(t *testing.T) {
 	secret := []byte("a-random-looking-test-key-with-32b")
-	token := signHS256(t, secret, jwt.MapClaims{"sub": "abc"})
+	token := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "abc"})
 
 	out, err := decodeJWTJSONMap(t, token, "raw:"+string(secret))
 	if err != nil {
diff --git a/jwe.go b/jwe.go
index f06108d..2159a17 100644
--- a/jwe.go
+++ b/jwe.go
@@ -47,6 +47,13 @@ func isJWE(token string) bool {
 	return strings.Count(token, ".") == 4
 }
 
+// isJWT returns true if the token string looks like a JWS/JWT compact
+// serialization (3 dot-separated parts). It is the counterpart of isJWE, so
+// token-shape dispatch has one definition per form.
+func isJWT(token string) bool {
+	return strings.Count(token, ".") == 2
+}
+
 // decodeAndPrintJWE parses a JWE token and prints its contents.
 // If keyStr is provided, the token is decrypted and the plaintext payload is displayed.
 // Otherwise, only the protected header and encrypted part metadata are shown.
@@ -112,27 +119,33 @@ func jweProtectedHeaderMap(token string) (map[string]any, error) {
 	return header, nil
 }
 
+// jweEncryptedParts splits a JWE compact serialization into its five segments,
+// reporting false when the token does not have them. Both output paths measure
+// the same segments, so the shape rule lives in one place.
+func jweEncryptedParts(tokenStr string) ([]string, bool) {
+	parts := strings.SplitN(tokenStr, ".", 5)
+	return parts, len(parts) == 5
+}
+
 // printEncryptedParts displays metadata about the encrypted JWE parts.
 func printEncryptedParts(w io.Writer, tokenStr string) error {
-	parts := strings.SplitN(tokenStr, ".", 5)
-	if len(parts) != 5 {
+	parts, ok := jweEncryptedParts(tokenStr)
+	if !ok {
 		return nil
 	}
 
 	if _, err := labelColor.Fprintln(w, "Encrypted Content"); err != nil {
 		return err
 	}
-	if _, err := dimColor.Fprintf(w, "Encrypted Key : %s\n", partSize(parts[1])); err != nil {
-		return err
-	}
-	if _, err := dimColor.Fprintf(w, "IV            : %s\n", partSize(parts[2])); err != nil {
-		return err
-	}
-	if _, err := dimColor.Fprintf(w, "Ciphertext    : %s\n", partSize(parts[3])); err != nil {
-		return err
-	}
-	if _, err := dimColor.Fprintf(w, "Auth Tag      : %s\n", partSize(parts[4])); err != nil {
-		return err
+	for _, part := range []struct{ label, segment string }{
+		{"Encrypted Key", parts[1]},
+		{"IV", parts[2]},
+		{"Ciphertext", parts[3]},
+		{"Auth Tag", parts[4]},
+	} {
+		if _, err := dimColor.Fprintf(w, "%-14s: %s\n", part.label, partSize(part.segment)); err != nil {
+			return err
+		}
 	}
 	if _, err := fmt.Fprintln(w); err != nil {
 		return err
@@ -141,12 +154,12 @@ func printEncryptedParts(w io.Writer, tokenStr string) error {
 	return err
 }
 
-// partSize describes the decoded byte length of a base64url-encoded JWE part,
-// flagging parts that are not valid base64url instead of reporting 0 bytes.
+// partSize renders the decoded byte length reported by base64URLLen, flagging
+// parts that are not valid base64url instead of reporting 0 bytes.
 func partSize(s string) string {
-	data, err := base64.RawURLEncoding.DecodeString(s)
-	if err != nil {
+	n := base64URLLen(s)
+	if n < 0 {
 		return "invalid base64url"
 	}
-	return fmt.Sprintf("%d bytes", len(data))
+	return fmt.Sprintf("%d bytes", n)
 }
diff --git a/jwe_test.go b/jwe_test.go
index f7d8ecc..87991b1 100644
--- a/jwe_test.go
+++ b/jwe_test.go
@@ -192,7 +192,7 @@ func TestDecodeAndPrintJWE_InvalidToken(t *testing.T) {
 
 func TestDecodeAndPrintJWE_WrongKey(t *testing.T) {
 	key := generateRSAKey(t)
-	wrongKey := generateRSAKey(t)
+	wrongKey := generateDistinctRSAKey(t)
 	token := encryptJWE(t, key, []byte(`{"sub":"user1"}`))
 	keyPath := writeKeyFile(t, wrongKey)
 
@@ -552,65 +552,33 @@ func TestDecodeAndPrintJWE_EndToEnd_WithDecrypt(t *testing.T) {
 }
 
 // --- Algorithm coverage: key management algorithms ---------------------------
+//
+// Each family runs the same two checks per algorithm — decode without a key
+// (header and encrypted-part metadata) and decode with one (decrypted payload)
+// — so they share assertJWEHeaderOnly/assertJWEDecrypts and differ only in how
+// the key for that family is made.
 
 func TestDecodeAndPrintJWE_RSAKeyAlgorithms(t *testing.T) {
 	tests := []struct {
 		name   string
 		keyAlg jose.KeyAlgorithm
-		algStr string
 	}{
-		{"RSA-OAEP", jose.RSA_OAEP, "RSA-OAEP"},
-		{"RSA-OAEP-256", jose.RSA_OAEP_256, "RSA-OAEP-256"},
-		{"RSA1_5", jose.RSA1_5, "RSA1_5"},
+		{"RSA-OAEP", jose.RSA_OAEP},
+		{"RSA-OAEP-256", jose.RSA_OAEP_256},
+		{"RSA1_5", jose.RSA1_5},
 	}
 
 	for _, tt := range tests {
+		key := generateRSAKey(t)
+
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			key := generateRSAKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"rsa-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "A128GCM") {
-				t.Error("output missing content encryption A128GCM")
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			assertJWEHeaderOnly(t, token, tt.name, "A128GCM")
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateRSAKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"rsa-test","role":"user"}`))
-			keyPath := writeKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "rsa-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "user") {
-				t.Error("output missing decrypted role value")
-			}
+			assertJWEDecrypts(t, token, writeKeyFile(t, key), "rsa-test", "user")
 		})
 	}
 }
@@ -619,250 +587,80 @@ func TestDecodeAndPrintJWE_ECDHESKeyAlgorithms(t *testing.T) {
 	tests := []struct {
 		name   string
 		keyAlg jose.KeyAlgorithm
-		algStr string
 	}{
-		{"ECDH-ES", jose.ECDH_ES, "ECDH-ES"},
-		{"ECDH-ES+A128KW", jose.ECDH_ES_A128KW, "ECDH-ES+A128KW"},
-		{"ECDH-ES+A192KW", jose.ECDH_ES_A192KW, "ECDH-ES+A192KW"},
-		{"ECDH-ES+A256KW", jose.ECDH_ES_A256KW, "ECDH-ES+A256KW"},
+		{"ECDH-ES", jose.ECDH_ES},
+		{"ECDH-ES+A128KW", jose.ECDH_ES_A128KW},
+		{"ECDH-ES+A192KW", jose.ECDH_ES_A192KW},
+		{"ECDH-ES+A256KW", jose.ECDH_ES_A256KW},
 	}
 
 	for _, tt := range tests {
+		key := generateECKey(t)
+
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			key := generateECKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"ec-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			assertJWEHeaderOnly(t, token, tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateECKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"ec-test","data":"secret"}`))
-			keyPath := writeECKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "ec-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "secret") {
-				t.Error("output missing decrypted data value")
-			}
+			assertJWEDecrypts(t, token, writeECKeyFile(t, key), "ec-test", "secret")
 		})
 	}
 }
 
-func TestDecodeAndPrintJWE_AESKWKeyAlgorithms(t *testing.T) {
+func TestDecodeAndPrintJWE_AESKeyWrappingAlgorithms(t *testing.T) {
 	tests := []struct {
 		name    string
 		keyAlg  jose.KeyAlgorithm
-		algStr  string
+		enc     jose.ContentEncryption
 		keySize int
 	}{
-		{"A128KW", jose.A128KW, "A128KW", 16},
-		{"A192KW", jose.A192KW, "A192KW", 24},
-		{"A256KW", jose.A256KW, "A256KW", 32},
+		{"A128KW", jose.A128KW, jose.A128GCM, 16},
+		{"A192KW", jose.A192KW, jose.A128GCM, 24},
+		{"A256KW", jose.A256KW, jose.A128GCM, 32},
+		{"A128GCMKW", jose.A128GCMKW, jose.A256GCM, 16},
+		{"A192GCMKW", jose.A192GCMKW, jose.A256GCM, 24},
+		{"A256GCMKW", jose.A256GCMKW, jose.A256GCM, 32},
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, symKey, []byte(`{"sub":"aeskw-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
-		})
-
-		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, symKey, []byte(`{"sub":"aeskw-test","msg":"hello"}`))
-			keyArg := symmetricKeyArg(t, symKey)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
+		symKey := randomSymmetricKey(t, tt.keySize)
 
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "aeskw-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "hello") {
-				t.Error("output missing decrypted msg value")
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrintJWE_AESGCMKWKeyAlgorithms(t *testing.T) {
-	tests := []struct {
-		name    string
-		keyAlg  jose.KeyAlgorithm
-		algStr  string
-		keySize int
-	}{
-		{"A128GCMKW", jose.A128GCMKW, "A128GCMKW", 16},
-		{"A192GCMKW", jose.A192GCMKW, "A192GCMKW", 24},
-		{"A256GCMKW", jose.A256GCMKW, "A256GCMKW", 32},
-	}
-
-	for _, tt := range tests {
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A256GCM, symKey, []byte(`{"sub":"aesgcmkw-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			token := encryptJWEGeneric(t, tt.keyAlg, tt.enc, symKey, []byte(`{"sub":"aeskw-test"}`))
+			assertJWEHeaderOnly(t, token, tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A256GCM, symKey, []byte(`{"sub":"aesgcmkw-test","status":"ok"}`))
-			keyArg := symmetricKeyArg(t, symKey)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "aesgcmkw-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "ok") {
-				t.Error("output missing decrypted status value")
-			}
+			token := encryptJWEGeneric(t, tt.keyAlg, tt.enc, symKey, []byte(`{"sub":"aeskw-test","msg":"hello"}`))
+			assertJWEDecrypts(t, token, symmetricKeyArg(t, symKey), "aeskw-test", "hello")
 		})
 	}
 }
 
 func TestDecodeAndPrintJWE_DirectKeyAgreement(t *testing.T) {
 	contentEncs := []struct {
-		name   string
-		enc    jose.ContentEncryption
-		encStr string
+		name string
+		enc  jose.ContentEncryption
 	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256, "A128CBC-HS256"},
-		{"A256CBC-HS512", jose.A256CBC_HS512, "A256CBC-HS512"},
-		{"A128GCM", jose.A128GCM, "A128GCM"},
-		{"A256GCM", jose.A256GCM, "A256GCM"},
+		{"A128CBC-HS256", jose.A128CBC_HS256},
+		{"A256CBC-HS512", jose.A256CBC_HS512},
+		{"A128GCM", jose.A128GCM},
+		{"A256GCM", jose.A256GCM},
 	}
 
 	for _, tt := range contentEncs {
+		symKey := symmetricKeyForEnc(t, tt.enc)
+
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			symKey := symmetricKeyForEnc(t, tt.enc)
 			token := encryptJWEGeneric(t, jose.DIRECT, tt.enc, symKey, []byte(`{"sub":"dir-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, "dir") {
-				t.Error("output missing algorithm 'dir'")
-			}
-			if !strings.Contains(plain, tt.encStr) {
-				t.Errorf("output missing content encryption %q", tt.encStr)
-			}
+			assertJWEHeaderOnly(t, token, "dir", tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			symKey := symmetricKeyForEnc(t, tt.enc)
 			token := encryptJWEGeneric(t, jose.DIRECT, tt.enc, symKey, []byte(`{"sub":"dir-test","val":"direct"}`))
-			keyArg := symmetricKeyArg(t, symKey)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "dir-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "direct") {
-				t.Error("output missing decrypted val value")
-			}
+			assertJWEDecrypts(t, token, symmetricKeyArg(t, symKey), "dir-test", "direct")
 		})
 	}
 }
@@ -871,59 +669,25 @@ func TestDecodeAndPrintJWE_PBES2KeyAlgorithms(t *testing.T) {
 	tests := []struct {
 		name   string
 		keyAlg jose.KeyAlgorithm
-		algStr string
 	}{
-		{"PBES2-HS256+A128KW", jose.PBES2_HS256_A128KW, "PBES2-HS256+A128KW"},
-		{"PBES2-HS384+A192KW", jose.PBES2_HS384_A192KW, "PBES2-HS384+A192KW"},
-		{"PBES2-HS512+A256KW", jose.PBES2_HS512_A256KW, "PBES2-HS512+A256KW"},
+		{"PBES2-HS256+A128KW", jose.PBES2_HS256_A128KW},
+		{"PBES2-HS384+A192KW", jose.PBES2_HS384_A192KW},
+		{"PBES2-HS512+A256KW", jose.PBES2_HS512_A256KW},
 	}
 
-	for _, tt := range tests {
-		password := []byte("test-password-for-jwtd")
+	password := []byte("test-password-for-jwtd")
 
+	for _, tt := range tests {
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, password, []byte(`{"sub":"pbes2-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			assertJWEHeaderOnly(t, token, tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, password, []byte(`{"sub":"pbes2-test","auth":"pass"}`))
 			// For PBES2 the "key" is a password, so it is passed as an
 			// explicit literal secret.
-			passwordArg := "raw:" + string(password)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, passwordArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "pbes2-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "pass") {
-				t.Error("output missing decrypted auth value")
-			}
+			assertJWEDecrypts(t, token, "raw:"+string(password), "pbes2-test", "pass")
 		})
 	}
 }
@@ -932,62 +696,28 @@ func TestDecodeAndPrintJWE_PBES2KeyAlgorithms(t *testing.T) {
 
 func TestDecodeAndPrintJWE_ContentEncryptionAlgorithms(t *testing.T) {
 	tests := []struct {
-		name   string
-		enc    jose.ContentEncryption
-		encStr string
+		name string
+		enc  jose.ContentEncryption
 	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256, "A128CBC-HS256"},
-		{"A192CBC-HS384", jose.A192CBC_HS384, "A192CBC-HS384"},
-		{"A256CBC-HS512", jose.A256CBC_HS512, "A256CBC-HS512"},
-		{"A128GCM", jose.A128GCM, "A128GCM"},
-		{"A192GCM", jose.A192GCM, "A192GCM"},
-		{"A256GCM", jose.A256GCM, "A256GCM"},
+		{"A128CBC-HS256", jose.A128CBC_HS256},
+		{"A192CBC-HS384", jose.A192CBC_HS384},
+		{"A256CBC-HS512", jose.A256CBC_HS512},
+		{"A128GCM", jose.A128GCM},
+		{"A192GCM", jose.A192GCM},
+		{"A256GCM", jose.A256GCM},
 	}
 
+	key := generateRSAKey(t)
+
 	for _, tt := range tests {
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			key := generateRSAKey(t)
 			token := encryptJWEGeneric(t, jose.RSA_OAEP, tt.enc, &key.PublicKey, []byte(`{"sub":"enc-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.encStr) {
-				t.Errorf("output missing content encryption %q", tt.encStr)
-			}
-			if !strings.Contains(plain, "RSA-OAEP") {
-				t.Error("output missing algorithm RSA-OAEP")
-			}
+			assertJWEHeaderOnly(t, token, tt.name, "RSA-OAEP")
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateRSAKey(t)
 			token := encryptJWEGeneric(t, jose.RSA_OAEP, tt.enc, &key.PublicKey, []byte(`{"sub":"enc-test","enc_alg":"tested"}`))
-			keyPath := writeKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "enc-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "tested") {
-				t.Error("output missing decrypted enc_alg value")
-			}
+			assertJWEDecrypts(t, token, writeKeyFile(t, key), "enc-test", "tested")
 		})
 	}
 }
@@ -995,83 +725,43 @@ func TestDecodeAndPrintJWE_ContentEncryptionAlgorithms(t *testing.T) {
 // --- Cross-algorithm combinations --------------------------------------------
 
 func TestDecodeAndPrintJWE_ECDHES_WithAllContentEncryptions(t *testing.T) {
-	contentEncs := []struct {
-		name string
-		enc  jose.ContentEncryption
-	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256},
-		{"A256CBC-HS512", jose.A256CBC_HS512},
-		{"A128GCM", jose.A128GCM},
-		{"A256GCM", jose.A256GCM},
+	contentEncs := []jose.ContentEncryption{
+		jose.A128CBC_HS256,
+		jose.A256CBC_HS512,
+		jose.A128GCM,
+		jose.A256GCM,
 	}
 
-	for _, tt := range contentEncs {
-		t.Run("ECDH-ES+A256KW/"+tt.name, func(t *testing.T) {
-			key := generateECKey(t)
-			token := encryptJWEGeneric(t, jose.ECDH_ES_A256KW, tt.enc, &key.PublicKey,
-				[]byte(`{"sub":"cross-test","msg":"combo"}`))
-			keyPath := writeECKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
+	key := generateECKey(t)
+	keyPath := writeECKeyFile(t, key)
 
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "cross-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "combo") {
-				t.Error("output missing decrypted msg value")
-			}
+	for _, enc := range contentEncs {
+		t.Run("ECDH-ES+A256KW/"+string(enc), func(t *testing.T) {
+			token := encryptJWEGeneric(t, jose.ECDH_ES_A256KW, enc, &key.PublicKey,
+				[]byte(`{"sub":"cross-test","msg":"combo"}`))
+			assertJWEDecrypts(t, token, keyPath, "cross-test", "combo")
 		})
 	}
 }
 
 func TestDecodeAndPrintJWE_A256KW_WithAllContentEncryptions(t *testing.T) {
-	contentEncs := []struct {
-		name string
-		enc  jose.ContentEncryption
-	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256},
-		{"A192CBC-HS384", jose.A192CBC_HS384},
-		{"A256CBC-HS512", jose.A256CBC_HS512},
-		{"A128GCM", jose.A128GCM},
-		{"A192GCM", jose.A192GCM},
-		{"A256GCM", jose.A256GCM},
+	contentEncs := []jose.ContentEncryption{
+		jose.A128CBC_HS256,
+		jose.A192CBC_HS384,
+		jose.A256CBC_HS512,
+		jose.A128GCM,
+		jose.A192GCM,
+		jose.A256GCM,
 	}
 
-	symKey := make([]byte, 32)
-	if _, err := rand.Read(symKey); err != nil {
-		t.Fatalf("generating key: %v", err)
-	}
+	symKey := randomSymmetricKey(t, 32)
 	keyArg := symmetricKeyArg(t, symKey)
 
-	for _, tt := range contentEncs {
-		t.Run("A256KW/"+tt.name, func(t *testing.T) {
-			token := encryptJWEGeneric(t, jose.A256KW, tt.enc, symKey,
+	for _, enc := range contentEncs {
+		t.Run("A256KW/"+string(enc), func(t *testing.T) {
+			token := encryptJWEGeneric(t, jose.A256KW, enc, symKey,
 				[]byte(`{"sub":"a256kw-combo","result":"success"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "a256kw-combo") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "success") {
-				t.Error("output missing decrypted result value")
-			}
+			assertJWEDecrypts(t, token, keyArg, "a256kw-combo", "success")
 		})
 	}
 }
@@ -1122,7 +812,7 @@ func TestDecodeAndPrintJWE_NestedJWT(t *testing.T) {
 	innerJWT := signJWT(t, signingKey, claims)
 
 	// Encrypt the JWT inside a JWE.
-	encKey := generateRSAKey(t)
+	encKey := generateDistinctRSAKey(t)
 	jweToken := encryptJWE(t, encKey, []byte(innerJWT))
 
 	encKeyPath := writeKeyFile(t, encKey)
diff --git a/keys.go b/keys.go
index 2f37b09..c9a9350 100644
--- a/keys.go
+++ b/keys.go
@@ -41,54 +41,77 @@ func loadKey(keyStr string) (any, error) {
 // token carries none); it only affects JWK Set selection and is ignored for
 // every other key form.
 func loadKeyForKID(keyStr, kid string) (any, error) {
-	// Explicit literal secret; no file or base64 detection.
-	if secret, ok := strings.CutPrefix(keyStr, "raw:"); ok {
-		return symmetricKey([]byte(secret))
+	// The precedence lives in classifyKeyArg and is applied here, so the
+	// reading the CLI reports is by construction the reading that happens.
+	switch classifyKeyArg(keyStr) {
+	case keySourceLiteral:
+		return symmetricKey([]byte(strings.TrimPrefix(keyStr, "raw:")))
+	case keySourceSecretFile:
+		return loadSymmetricKeyFile(strings.TrimPrefix(keyStr, "hmac:"))
+	case keySourceFile:
+		return loadKeyFile(keyStr, kid)
+	case keySourceBase64:
+		return loadInlineKey(keyStr, kid)
+	default:
+		return nil, fmt.Errorf("key is neither a valid file path nor base64-encoded data")
 	}
+}
 
-	// Explicit symmetric key file. Keeps secret bytes out of argv, where
-	// other local users can read them, and covers binary secrets that cannot
-	// be passed as text.
-	if path, ok := strings.CutPrefix(keyStr, "hmac:"); ok {
-		data, err := os.ReadFile(path)
-		if err != nil {
-			return nil, fmt.Errorf("reading symmetric key file %q: %w", path, err)
-		}
-		// Text secrets get the trailing newline editors typically add
-		// trimmed; binary key material is used byte-exact.
-		if isTextKey(data) {
-			data = bytes.TrimRight(data, "\r\n")
-		}
-		return symmetricKey(data)
+// loadSymmetricKeyFile reads an explicit hmac: secret file. Keeping the secret
+// bytes in a file rather than argv keeps them out of the process list, and
+// covers binary secrets that cannot be passed as text.
+func loadSymmetricKeyFile(path string) (any, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading symmetric key file %q: %w", path, err)
 	}
+	// Text secrets get the trailing newline editors typically add trimmed;
+	// binary key material is used byte-exact.
+	if isTextKey(data) {
+		data = bytes.TrimRight(data, "\r\n")
+	}
+	return symmetricKey(data)
+}
 
-	// Try as file path first.
-	if data, err := os.ReadFile(keyStr); err == nil {
-		if len(data) == 0 {
-			return nil, fmt.Errorf("key file %q is empty", keyStr)
-		}
-		if key, err := parseKeyData(data, kid); err == nil {
-			return key, nil
-		} else if errors.Is(err, errKIDNotFound) {
-			// The file is a valid JWK Set; a kid miss is final, not a reason
-			// to try base64 or fall through to the unsupported-format error.
-			return nil, err
-		}
-		// A text file may hold base64-encoded key material just as an inline
-		// key argument can, so the same bytes mean the same key either way.
-		if isTextKey(data) {
-			if decoded, ok := decodeBase64Key(bytes.TrimRight(data, "\r\n")); ok {
-				if key, err := parseKeyData(decoded, kid); err == nil {
-					return key, nil
-				} else if errors.Is(err, errKIDNotFound) {
-					return nil, err
-				}
+// loadKeyFile parses structured key material from a file, falling back to
+// base64-decoding its contents so a text file holding encoded key material
+// means the same key as that material passed inline.
+func loadKeyFile(path, kid string) (any, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading key file %q: %w", path, err)
+	}
+	if len(data) == 0 {
+		return nil, fmt.Errorf("key file %q is empty", path)
+	}
+
+	key, err := parseKeyData(data, kid)
+	if err == nil {
+		return key, nil
+	}
+	// The file is a valid JWK Set; a kid miss is final, not a reason to try
+	// base64 or fall through to the unsupported-format error.
+	if errors.Is(err, errKIDNotFound) {
+		return nil, err
+	}
+
+	if isTextKey(data) {
+		if decoded, ok := decodeBase64Key(bytes.TrimRight(data, "\r\n")); ok {
+			key, err := parseKeyData(decoded, kid)
+			if err == nil {
+				return key, nil
+			}
+			if errors.Is(err, errKIDNotFound) {
+				return nil, err
 			}
 		}
-		return nil, unsupportedKeyError(data, fmt.Sprintf("key file %q", keyStr), "hmac:"+keyStr)
 	}
+	return nil, unsupportedKeyError(data, fmt.Sprintf("key file %q", path), "hmac:"+path)
+}
 
-	// Try as base64-encoded key.
+// loadInlineKey parses base64/base64url key material given directly on the
+// command line or in JWTD_KEY.
+func loadInlineKey(keyStr, kid string) (any, error) {
 	decoded, ok := decodeBase64Key([]byte(keyStr))
 	if !ok {
 		return nil, fmt.Errorf("key is neither a valid file path nor base64-encoded data")
@@ -125,9 +148,10 @@ func symmetricKey(data []byte) (any, error) {
 	return data, nil
 }
 
-// keySource describes how loadKey will read a key argument. The CLI reports
-// it when the reading is not the obvious one, so a key that is silently taken
-// as something other than what the user meant becomes visible.
+// keySource describes how a key argument is read. It drives loadKeyForKID's
+// dispatch, and the CLI reports it when the reading is not the obvious one, so
+// a key silently taken as something other than what the user meant becomes
+// visible.
 type keySource int
 
 const (
@@ -143,10 +167,12 @@ const (
 	keySourceUnusable
 )
 
-// classifyKeyArg reports how loadKey will interpret keyStr, mirroring its
-// precedence: the explicit prefixes, then an existing file, then base64.
-// Existence is checked with Stat rather than a read, so classifying never
-// consumes the key source.
+// classifyKeyArg decides how a key argument is read: the explicit prefixes
+// first, then an existing file, then base64. loadKeyForKID dispatches on this
+// and the CLI narrates it, so the reported reading is the reading that happens
+// rather than a second copy of the ladder that could drift from it. Existence
+// is checked with Stat rather than a read, so classifying never consumes the
+// key source.
 func classifyKeyArg(keyStr string) keySource {
 	if strings.HasPrefix(keyStr, "raw:") {
 		return keySourceLiteral
@@ -263,35 +289,40 @@ func parseKeyData(data []byte, kid string) (any, error) {
 		return parseDERKey(block.Bytes, block.Type)
 	}
 
-	// Try raw DER parsing (private keys).
-	if key, err := x509.ParsePKCS8PrivateKey(data); err == nil {
+	// Try raw DER parsing.
+	if key, ok := parseAnyDER(data); ok {
 		return key, nil
 	}
-	if key, err := x509.ParsePKCS1PrivateKey(data); err == nil {
-		return key, nil
+
+	// The rejection is phrased by unsupportedKeyError, which is the single
+	// place that knows the user-facing subject and the symmetric-form hint.
+	return nil, fmt.Errorf("unrecognized key format")
+}
+
+// parseAnyDER tries every supported DER encoding, private keys first and then
+// public ones, reporting whether any of them accepted the bytes. It backs both
+// the raw-DER path and the fallback for an unrecognized PEM block type, so the
+// set of understood encodings is defined once.
+func parseAnyDER(der []byte) (any, bool) {
+	if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
+		return key, true
 	}
-	if key, err := x509.ParseECPrivateKey(data); err == nil {
-		return key, nil
+	if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
+		return key, true
 	}
-
-	// Try raw DER parsing (public keys).
-	if key, err := x509.ParsePKIXPublicKey(data); err == nil {
-		return key, nil
+	if key, err := x509.ParseECPrivateKey(der); err == nil {
+		return key, true
 	}
-	if key, err := x509.ParsePKCS1PublicKey(data); err == nil {
-		return key, nil
+	if key, err := x509.ParsePKIXPublicKey(der); err == nil {
+		return key, true
 	}
-	if cert, err := x509.ParseCertificate(data); err == nil {
-		return cert.PublicKey, nil
+	if key, err := x509.ParsePKCS1PublicKey(der); err == nil {
+		return key, true
 	}
-
-	if isSSHPublicKey(data) {
-		// ssh-keygen's PKCS8 export covers RSA and ECDSA keys only, so the
-		// hint does not promise it for Ed25519.
-		return nil, fmt.Errorf("SSH public key format is not supported; supply the key as PEM, DER, or JWK (for RSA and ECDSA keys: ssh-keygen -e -m PKCS8 -f <key>)")
+	if cert, err := x509.ParseCertificate(der); err == nil {
+		return cert.PublicKey, true
 	}
-
-	return nil, fmt.Errorf("unrecognized key format")
+	return nil, false
 }
 
 // parseDERKey parses DER-encoded key bytes based on the PEM block type.
@@ -315,25 +346,9 @@ func parseDERKey(der []byte, blockType string) (any, error) {
 		}
 		return cert.PublicKey, nil
 	default:
-		// Try all parsers (private keys first, then public).
-		if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
-			return key, nil
-		}
-		if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
-			return key, nil
-		}
-		if key, err := x509.ParseECPrivateKey(der); err == nil {
-			return key, nil
-		}
-		if key, err := x509.ParsePKIXPublicKey(der); err == nil {
+		if key, ok := parseAnyDER(der); ok {
 			return key, nil
 		}
-		if key, err := x509.ParsePKCS1PublicKey(der); err == nil {
-			return key, nil
-		}
-		if cert, err := x509.ParseCertificate(der); err == nil {
-			return cert.PublicKey, nil
-		}
 		return nil, fmt.Errorf("unable to parse key from PEM block type %q", blockType)
 	}
 }
diff --git a/keys_test.go b/keys_test.go
index 4f664f0..669158d 100644
--- a/keys_test.go
+++ b/keys_test.go
@@ -11,7 +11,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"encoding/pem"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -100,10 +99,7 @@ func TestLoadKey_RawPrefix(t *testing.T) {
 }
 
 func TestLoadKey_TextKeyFileTrimsTrailingNewline(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "secret.txt")
-	if err := os.WriteFile(path, []byte("my-text-secret\n"), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
+	path := writeTempFile(t, "secret.txt", []byte("my-text-secret\n"))
 
 	loaded, err := loadKey("hmac:" + path)
 	if err != nil {
@@ -242,10 +238,7 @@ func TestLoadKey_PKCS1RSAPublicKeyFromPEMFile(t *testing.T) {
 	priv := generateRSAKey(t)
 	der := x509.MarshalPKCS1PublicKey(&priv.PublicKey)
 	block := &pem.Block{Type: "RSA PUBLIC KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-rsa-pub-pkcs1.pem")
-	if err := os.WriteFile(path, pem.EncodeToMemory(block), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
+	path := writeTempFile(t, "test-rsa-pub-pkcs1.pem", pem.EncodeToMemory(block))
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -360,10 +353,7 @@ func TestLoadKey_RejectsMalformedStructuredData(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Run("file", func(t *testing.T) {
-				path := filepath.Join(t.TempDir(), "structured-key")
-				if err := os.WriteFile(path, tt.data, 0600); err != nil {
-					t.Fatalf("writing structured key data: %v", err)
-				}
+				path := writeTempFile(t, "structured-key", tt.data)
 				if loaded, err := loadKey(path); err == nil {
 					t.Fatalf("expected parsing error, got %T", loaded)
 				} else if !strings.Contains(err.Error(), path) {
@@ -405,10 +395,7 @@ func TestLoadKey_OpaqueDataRequiresExplicitSymmetricForm(t *testing.T) {
 				t.Run(mode, func(t *testing.T) {
 					input := base64.StdEncoding.EncodeToString(tt.data)
 					if mode == "file" {
-						input = filepath.Join(t.TempDir(), "opaque-key")
-						if err := os.WriteFile(input, tt.data, 0600); err != nil {
-							t.Fatalf("writing opaque key: %v", err)
-						}
+						input = writeTempFile(t, "opaque-key", tt.data)
 					}
 
 					if loaded, err := loadKey(input); err == nil {
@@ -424,15 +411,7 @@ func TestLoadKey_OpaqueDataRequiresExplicitSymmetricForm(t *testing.T) {
 
 func TestLoadKey_RSAPrivateKeyFromJWKFile(t *testing.T) {
 	priv := generateRSAKey(t)
-	jwk := jose.JSONWebKey{Key: priv, KeyID: "test-rsa"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "rsa-priv.jwk")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "rsa-priv.jwk", priv, "test-rsa")
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -450,15 +429,7 @@ func TestLoadKey_RSAPrivateKeyFromJWKFile(t *testing.T) {
 
 func TestLoadKey_RSAPublicKeyFromJWKFile(t *testing.T) {
 	priv := generateRSAKey(t)
-	jwk := jose.JSONWebKey{Key: &priv.PublicKey, KeyID: "test-rsa-pub"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "rsa-pub.jwk")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "rsa-pub.jwk", &priv.PublicKey, "test-rsa-pub")
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -476,15 +447,7 @@ func TestLoadKey_RSAPublicKeyFromJWKFile(t *testing.T) {
 
 func TestLoadKey_ECPrivateKeyFromJWKFile(t *testing.T) {
 	priv := generateECKey(t)
-	jwk := jose.JSONWebKey{Key: priv, KeyID: "test-ec"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "ec-priv.jwk")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "ec-priv.jwk", priv, "test-ec")
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -502,21 +465,11 @@ func TestLoadKey_ECPrivateKeyFromJWKFile(t *testing.T) {
 
 func TestLoadKey_JWKSetFirstKey(t *testing.T) {
 	priv1 := generateRSAKey(t)
-	priv2 := generateRSAKey(t)
-	jwks := jose.JSONWebKeySet{
-		Keys: []jose.JSONWebKey{
-			{Key: &priv1.PublicKey, KeyID: "key-1"},
-			{Key: &priv2.PublicKey, KeyID: "key-2"},
-		},
-	}
-	data, err := json.Marshal(jwks)
-	if err != nil {
-		t.Fatalf("marshaling JWK Set: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "jwks.json")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK Set file: %v", err)
-	}
+	priv2 := generateDistinctRSAKey(t)
+	path := writeJWKSetFile(t, "jwks.json",
+		jose.JSONWebKey{Key: &priv1.PublicKey, KeyID: "key-1"},
+		jose.JSONWebKey{Key: &priv2.PublicKey, KeyID: "key-2"},
+	)
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -539,21 +492,11 @@ func TestLoadKey_JWKSetFirstKey(t *testing.T) {
 func writeJWKSet(t *testing.T) (path string, priv1, priv2 *rsa.PrivateKey) {
 	t.Helper()
 	priv1 = generateRSAKey(t)
-	priv2 = generateRSAKey(t)
-	jwks := jose.JSONWebKeySet{
-		Keys: []jose.JSONWebKey{
-			{Key: &priv1.PublicKey, KeyID: "key-1"},
-			{Key: &priv2.PublicKey, KeyID: "key-2"},
-		},
-	}
-	data, err := json.Marshal(jwks)
-	if err != nil {
-		t.Fatalf("marshaling JWK Set: %v", err)
-	}
-	path = filepath.Join(t.TempDir(), "jwks.json")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK Set file: %v", err)
-	}
+	priv2 = generateDistinctRSAKey(t)
+	path = writeJWKSetFile(t, "jwks.json",
+		jose.JSONWebKey{Key: &priv1.PublicKey, KeyID: "key-1"},
+		jose.JSONWebKey{Key: &priv2.PublicKey, KeyID: "key-2"},
+	)
 	return path, priv1, priv2
 }
 
@@ -606,15 +549,7 @@ func TestLoadKeyForKID_UnknownKIDFailsClosed(t *testing.T) {
 // behavior is preserved and verification fails naturally on a genuine mismatch.
 func TestLoadKeyForKID_SingleJWKIgnoresKID(t *testing.T) {
 	priv := generateRSAKey(t)
-	jwk := jose.JSONWebKey{Key: &priv.PublicKey, KeyID: "the-only-key"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "jwk.json")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "jwk.json", &priv.PublicKey, "the-only-key")
 
 	loaded, err := loadKeyForKID(path, "some-other-kid")
 	if err != nil {
diff --git a/main.go b/main.go
index 3cae41e..0e568b0 100644
--- a/main.go
+++ b/main.go
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"os"
 	"strings"
 
@@ -110,7 +111,12 @@ func run(cmd *cobra.Command, args []string) error {
 // either fails, with the signature verdict taking precedence for the returned
 // sentinel (both are suppressed by the top-level error printer).
 func decodeJWTHuman(w io.Writer, tokenStr, keyStr string, checks claimChecks) error {
-	derr := decodeAndPrint(w, tokenStr, keyStr)
+	p, err := parseUnverifiedJWT(tokenStr)
+	if err != nil {
+		return err
+	}
+
+	derr := printParsedJWT(w, p, keyStr)
 	if derr != nil && !errors.Is(derr, errInvalidSignature) {
 		return derr
 	}
@@ -120,7 +126,7 @@ func decodeJWTHuman(w io.Writer, tokenStr, keyStr string, checks claimChecks) er
 		if _, err := fmt.Fprintln(w); err != nil {
 			return err
 		}
-		cerr = verifyClaims(w, tokenStr, checks)
+		cerr = printClaimsVerdict(w, p.claims, checks)
 		if cerr != nil && !errors.Is(cerr, errInvalidClaims) {
 			return cerr
 		}
@@ -240,27 +246,36 @@ func readInteractive() (token string, err error) {
 // decodeAndPrint parses the JWT and prints header, payload, and signature.
 // If keyStr is provided, the signature is verified against the given key.
 func decodeAndPrint(w io.Writer, tokenStr, keyStr string) error {
-	token, parts, claims, err := parseUnverifiedJWT(tokenStr)
+	p, err := parseUnverifiedJWT(tokenStr)
 	if err != nil {
 		return err
 	}
+	return printParsedJWT(w, p, keyStr)
+}
 
+// printParsedJWT renders an already-parsed token, so callers that also need the
+// claims (claim validation) or the header (signature verification) parse once
+// and share the result instead of decoding the same segments again.
+func printParsedJWT(w io.Writer, p *parsedJWT, keyStr string) error {
 	f := newFormatter()
 
-	if err := printSection(w, f, "Header", token.Header); err != nil {
+	if err := printSection(w, f, "Header", p.token.Header); err != nil {
 		return err
 	}
 	if _, err := fmt.Fprintln(w); err != nil {
 		return err
 	}
-	formatTimestamps(claims)
-	if err := printSection(w, f, "Payload", claims); err != nil {
+	// formatTimestamps rewrites claim values into display strings, so it runs
+	// on a copy: p.claims stays the authoritative parse for validation.
+	display := maps.Clone(p.claims)
+	formatTimestamps(display)
+	if err := printSection(w, f, "Payload", display); err != nil {
 		return err
 	}
 	if _, err := fmt.Fprintln(w); err != nil {
 		return err
 	}
-	if err := printSignature(w, parts[2]); err != nil {
+	if err := printSignature(w, p.parts[2]); err != nil {
 		return err
 	}
 
@@ -268,7 +283,7 @@ func decodeAndPrint(w io.Writer, tokenStr, keyStr string) error {
 		if _, err := fmt.Fprintln(w); err != nil {
 			return err
 		}
-		if err := verifySignature(w, tokenStr, keyStr); err != nil {
+		if err := printSignatureVerdict(w, p, keyStr); err != nil {
 			return err
 		}
 	}
@@ -276,16 +291,27 @@ func decodeAndPrint(w io.Writer, tokenStr, keyStr string) error {
 	return nil
 }
 
-func parseUnverifiedJWT(tokenStr string) (*jwt.Token, []string, jwt.MapClaims, error) {
+// parsedJWT is one strict decode of a compact JWT: the token with its
+// display-decoded header, its three segments, and its claims. It is threaded
+// through the decode, signature, and claim steps so a single run parses the
+// token once rather than once per step.
+type parsedJWT struct {
+	raw    string
+	token  *jwt.Token
+	parts  []string
+	claims jwt.MapClaims
+}
+
+func parseUnverifiedJWT(tokenStr string) (*parsedJWT, error) {
 	parser := jwt.NewParser(jwt.WithJSONNumber())
 	token, parts, err := parser.ParseUnverified(tokenStr, jwt.MapClaims{})
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT: %w", err)
+		return nil, fmt.Errorf("parsing JWT: %w", err)
 	}
 
 	headerData, err := parser.DecodeSegment(parts[0])
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT header: decoding header: %w", err)
+		return nil, fmt.Errorf("parsing JWT header: decoding header: %w", err)
 	}
 
 	// Re-decode the header for display with the same strictness as the
@@ -293,40 +319,38 @@ func parseUnverifiedJWT(tokenStr string) (*jwt.Token, []string, jwt.MapClaims, e
 	// decodes it with plain json.Unmarshal, which loses number precision.
 	header := map[string]any{}
 	if err := decodeJSON(headerData, &header); err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT header: %w", err)
+		return nil, fmt.Errorf("parsing JWT header: %w", err)
 	}
 	token.Header = header
 
 	payload, err := parser.DecodeSegment(parts[1])
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT claims: decoding payload: %w", err)
+		return nil, fmt.Errorf("parsing JWT claims: decoding payload: %w", err)
 	}
 
 	claims := jwt.MapClaims{}
 	if err := decodeJSON(payload, &claims); err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT claims: %w", err)
+		return nil, fmt.Errorf("parsing JWT claims: %w", err)
 	}
-	return token, parts, claims, nil
+	return &parsedJWT{raw: tokenStr, token: token, parts: parts, claims: claims}, nil
 }
 
-// verifySignature verifies a JWT signature using the provided key and prints the result.
-func verifySignature(w io.Writer, tokenStr, keyStr string) error {
-	valid, reason, err := verifyJWTSignature(tokenStr, keyStr)
+// printSignatureVerdict renders the signature verdict for an already-parsed
+// token and returns the errInvalidSignature sentinel on failure so the CLI
+// exits nonzero.
+func printSignatureVerdict(w io.Writer, p *parsedJWT, keyStr string) error {
+	valid, reason, err := verifyJWTSignature(p, keyStr)
 	if err != nil {
 		return fmt.Errorf("signature verification: %w", err)
 	}
 
 	if !valid {
-		if _, werr := color.New(color.FgRed, color.Bold).Fprintln(w, "Signature: INVALID"); werr != nil {
-			return werr
-		}
-		if _, werr := dimColor.Fprintf(w, "  %v\n", reason); werr != nil {
+		if werr := printVerdict(w, "Signature", false, reason.Error()); werr != nil {
 			return werr
 		}
 		return fmt.Errorf("%w: %v", errInvalidSignature, reason)
 	}
-	_, werr := color.New(color.FgGreen, color.Bold).Fprintln(w, "Signature: VALID")
-	return werr
+	return printVerdict(w, "Signature", true, "")
 }
 
 // verifyJWTSignature performs the cryptographic signature check and reports the
@@ -335,13 +359,8 @@ func verifySignature(w io.Writer, tokenStr, keyStr string) error {
 // non-nil reason for a genuinely invalid signature; and a non-nil err only for
 // hard failures (unparseable token, unusable key) that are not a verdict on the
 // signature itself.
-func verifyJWTSignature(tokenStr, keyStr string) (valid bool, reason error, err error) {
-	token, _, _, err := parseUnverifiedJWT(tokenStr)
-	if err != nil {
-		return false, nil, err
-	}
-
-	key, err := loadKeyForKID(keyStr, headerKID(token.Header))
+func verifyJWTSignature(p *parsedJWT, keyStr string) (valid bool, reason error, err error) {
+	key, err := loadKeyForKID(keyStr, headerKID(p.token.Header))
 	if err != nil {
 		return false, nil, fmt.Errorf("error loading key: %w", err)
 	}
@@ -358,7 +377,7 @@ func verifyJWTSignature(tokenStr, keyStr string) (valid bool, reason error, err
 		opts = append(opts, jwt.WithValidMethods(methods))
 	}
 	parser := jwt.NewParser(opts...)
-	if _, perr := parser.Parse(tokenStr, func(*jwt.Token) (any, error) {
+	if _, perr := parser.Parse(p.raw, func(*jwt.Token) (any, error) {
 		return key, nil
 	}); perr != nil {
 		return false, perr, nil
diff --git a/main_test.go b/main_test.go
index c432992..eac68fa 100644
--- a/main_test.go
+++ b/main_test.go
@@ -11,7 +11,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -574,7 +573,7 @@ func TestVerifySignature_RejectsForgedHMACFromPublishedKeyFile(t *testing.T) {
 			// The attacker signs with exactly what the victim's key file
 			// holds, trailing newline trimmed as jwtd trims it.
 			secret := []byte(strings.TrimRight(tt.contents, "\n"))
-			forged := signHS256(t, secret, jwt.MapClaims{"sub": "attacker", "role": "admin"})
+			forged := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "attacker", "role": "admin"})
 
 			var buf bytes.Buffer
 			err := verifySignature(&buf, forged, keyPath)
@@ -626,7 +625,7 @@ func TestDecodeAndPrint_SignatureValid_RSAPublicKey(t *testing.T) {
 
 func TestDecodeAndPrint_SignatureInvalid_WrongKey(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKey := generateRSAKey(t)
+	wrongKey := generateDistinctRSAKey(t)
 	wrongKeyPath := writeKeyFile(t, wrongKey)
 	claims := jwt.MapClaims{"sub": "test"}
 	token := signJWT(t, signingKey, claims)
@@ -645,7 +644,7 @@ func TestDecodeAndPrint_SignatureInvalid_WrongKey(t *testing.T) {
 
 func TestVerifySignature_InvalidOutputWriterErrors(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKeyPath := writeKeyFile(t, generateRSAKey(t))
+	wrongKeyPath := writeKeyFile(t, generateDistinctRSAKey(t))
 	token := signJWT(t, signingKey, jwt.MapClaims{"sub": "test"})
 
 	tests := []struct {
@@ -711,171 +710,61 @@ func TestDecodeAndPrint_CertificateCannotBecomeHMACSecret(t *testing.T) {
 	}
 }
 
-func TestDecodeAndPrint_RejectsBOMPrefixedPublicJWKAsHMACSecret(t *testing.T) {
+// TestDecodeAndPrint_UnparseableKeyNeverBecomesHMACSecret pins the post-5.0.0
+// property that key material jwtd cannot parse is rejected outright rather than
+// falling back to an HMAC secret. Each row signs a token with the key bytes
+// themselves, which is exactly what an attacker who knows a published key can
+// do, and asserts the signature is never reported valid. The rows are the
+// inputs that reached the old fallback through its various heuristics; the
+// heuristics are gone, so they share one body.
+func TestDecodeAndPrint_UnparseableKeyNeverBecomesHMACSecret(t *testing.T) {
 	rsaKey := generateRSAKey(t)
-	jwkData, err := json.Marshal(jose.JSONWebKey{Key: &rsaKey.PublicKey})
+	publicJWK, err := json.Marshal(jose.JSONWebKey{Key: &rsaKey.PublicKey})
 	if err != nil {
 		t.Fatalf("marshaling public JWK: %v", err)
 	}
-	jwkData = append([]byte{0xef, 0xbb, 0xbf}, jwkData...)
-	keyPath := filepath.Join(t.TempDir(), "public.jwk")
-	if err := os.WriteFile(keyPath, jwkData, 0600); err != nil {
-		t.Fatalf("writing public JWK: %v", err)
-	}
-	token := signJWTWithHMAC(t, jwkData, jwt.MapClaims{"sub": "test"})
-
-	var buf bytes.Buffer
-	if err := decodeAndPrint(&buf, token, keyPath); err == nil {
-		t.Fatalf("expected BOM-prefixed public JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-	}
-	if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-		t.Fatalf("public JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-	}
-}
-
-func TestDecodeAndPrint_RejectsEscapedJWKMemberAsHMACSecret(t *testing.T) {
-	jwkData := []byte(`{"\u006bty":"oct","k":`)
-	keyPath := filepath.Join(t.TempDir(), "malformed.jwk")
-	if err := os.WriteFile(keyPath, jwkData, 0600); err != nil {
-		t.Fatalf("writing malformed JWK: %v", err)
-	}
-	token := signJWTWithHMAC(t, jwkData, jwt.MapClaims{"sub": "test"})
+	bomPublicJWK := append([]byte{0xef, 0xbb, 0xbf}, publicJWK...)
 
-	var buf bytes.Buffer
-	if err := decodeAndPrint(&buf, token, keyPath); err == nil {
-		t.Fatalf("expected escaped JWK member to be rejected, got output:\n%s", stripANSI(buf.String()))
-	}
-	if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-		t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-	}
-}
-
-func TestDecodeAndPrint_RejectsLaterMalformedJWKMembersAsHMACSecrets(t *testing.T) {
 	tests := []struct {
 		name string
 		data []byte
 	}{
+		{name: "BOM-prefixed public JWK", data: bomPublicJWK},
+		{name: "escaped JWK member", data: []byte(`{"\u006bty":"oct","k":`)},
 		{name: "literal kty after malformed value", data: []byte(`{"bad":truX,"kty":"RSA","n":"public"}`)},
 		{name: "escaped kty after malformed value", data: []byte(`{"bad":truX,"\u006bty":"RSA","n":"public"}`)},
 		{name: "later keys", data: []byte(`{"bad":truX,"keys":[`)},
 		{name: "kty truncated before colon", data: []byte(`{"bad":truX,"kty"`)},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			keyPath := filepath.Join(t.TempDir(), "malformed.jwk")
-			if err := os.WriteFile(keyPath, tt.data, 0600); err != nil {
-				t.Fatalf("writing malformed JWK: %v", err)
-			}
-			token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
-
-			var buf bytes.Buffer
-			if err := decodeAndPrint(&buf, token, keyPath); err == nil {
-				t.Fatalf("expected malformed JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-			}
-			if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-				t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrint_RejectsMissingCommaJWKMembersAsHMACSecrets(t *testing.T) {
-	tests := []struct {
-		name      string
-		data      []byte
-		useBase64 bool
-	}{
-		{name: "literal kty", data: []byte(`{"note":"x" "kty":"RSA","n":"public"}`)},
-		{name: "escaped kty", data: []byte(`{"note":"x" "\u006bty":"RSA","n":"public"}`)},
-		{name: "literal kty at EOF", data: []byte(`{"note":"x" "kty"`)},
-		{name: "escaped keys at EOF after malformed value via base64", data: []byte(`{"bad":truX "\u006b\u0065\u0079\u0073"`), useBase64: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			keyInput := base64.StdEncoding.EncodeToString(tt.data)
-			if !tt.useBase64 {
-				keyInput = filepath.Join(t.TempDir(), "malformed.jwk")
-				if err := os.WriteFile(keyInput, tt.data, 0600); err != nil {
-					t.Fatalf("writing malformed JWK: %v", err)
-				}
-			}
-			token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
-
-			var buf bytes.Buffer
-			if err := decodeAndPrint(&buf, token, keyInput); err == nil {
-				t.Fatalf("expected malformed JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-			}
-			if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-				t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrint_RejectsMalformedJWKMemberSeparatorsAsHMACSecrets(t *testing.T) {
-	tests := []struct {
-		name      string
-		data      []byte
-		useBase64 bool
-	}{
+		{name: "missing comma before literal kty", data: []byte(`{"note":"x" "kty":"RSA","n":"public"}`)},
+		{name: "missing comma before escaped kty", data: []byte(`{"note":"x" "\u006bty":"RSA","n":"public"}`)},
+		{name: "missing comma before literal kty at EOF", data: []byte(`{"note":"x" "kty"`)},
+		{name: "escaped keys at EOF after malformed value", data: []byte(`{"bad":truX "\u006b\u0065\u0079\u0073"`)},
 		{name: "literal kty with missing colon", data: []byte(`{"kty" "RSA","n":"public"}`)},
-		{name: "escaped kty with replaced colon via base64", data: []byte(`{"\u006bty";"RSA","n":"public"}`), useBase64: true},
+		{name: "escaped kty with replaced colon", data: []byte(`{"\u006bty";"RSA","n":"public"}`)},
 		{name: "literal keys with replaced colon", data: []byte(`{"keys"=[{"kty":"RSA"}]}`)},
-		{name: "escaped keys with missing colon via base64", data: []byte(`{"\u006b\u0065\u0079\u0073" [{"kty":"RSA"}]}`), useBase64: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			keyInput := base64.StdEncoding.EncodeToString(tt.data)
-			if !tt.useBase64 {
-				keyInput = filepath.Join(t.TempDir(), "malformed.jwk")
-				if err := os.WriteFile(keyInput, tt.data, 0600); err != nil {
-					t.Fatalf("writing malformed JWK: %v", err)
-				}
-			}
-			token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
-
-			var buf bytes.Buffer
-			if err := decodeAndPrint(&buf, token, keyInput); err == nil {
-				t.Fatalf("expected malformed JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-			}
-			if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-				t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrint_RejectsIncompleteJSONObjectKeysAsHMACSecrets(t *testing.T) {
-	tests := []struct {
-		name string
-		data []byte
-	}{
+		{name: "escaped keys with missing colon", data: []byte(`{"\u006b\u0065\u0079\u0073" [{"kty":"RSA"}]}`)},
 		{name: "truncated kty member", data: []byte(`{"kty`)},
 		{name: "malformed JWK fields without kty", data: []byte(`{"n":"public","e":"AQAB",`)},
 	}
 
+	// Both readings of a key argument reach the same rejection, so every row
+	// runs as a file and as inline base64.
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			for _, mode := range []string{"file", "base64"} {
 				t.Run(mode, func(t *testing.T) {
 					keyInput := base64.StdEncoding.EncodeToString(tt.data)
 					if mode == "file" {
-						keyInput = filepath.Join(t.TempDir(), "malformed.jwk")
-						if err := os.WriteFile(keyInput, tt.data, 0600); err != nil {
-							t.Fatalf("writing malformed JWK: %v", err)
-						}
+						keyInput = writeTempFile(t, "malformed.jwk", tt.data)
 					}
 					token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
 
 					var buf bytes.Buffer
 					if err := decodeAndPrint(&buf, token, keyInput); err == nil {
-						t.Fatalf("expected malformed JSON object key to be rejected, got output:\n%s", stripANSI(buf.String()))
+						t.Fatalf("expected unparseable key material to be rejected, got output:\n%s", stripANSI(buf.String()))
 					}
 					if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-						t.Fatalf("malformed JSON object key was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
+						t.Fatalf("unparseable key material was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
 					}
 				})
 			}
@@ -969,10 +858,7 @@ func TestDecodeAndPrint_SignatureValid_Ed25519PublicKey(t *testing.T) {
 		t.Fatalf("marshaling Ed25519 public key: %v", err)
 	}
 	block := &pem.Block{Type: "PUBLIC KEY", Bytes: der}
-	pubKeyPath := filepath.Join(t.TempDir(), "test-ed25519-pub.pem")
-	if err := os.WriteFile(pubKeyPath, pem.EncodeToMemory(block), 0600); err != nil {
-		t.Fatalf("writing public key file: %v", err)
-	}
+	pubKeyPath := writeTempFile(t, "test-ed25519-pub.pem", pem.EncodeToMemory(block))
 
 	var buf bytes.Buffer
 	err = decodeAndPrint(&buf, token, pubKeyPath)
@@ -1075,7 +961,7 @@ func TestRun_JWTDKeyEnvVar_JWSVerification(t *testing.T) {
 
 func TestRun_KeyFlagOverridesEnvVar(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKey := generateRSAKey(t)
+	wrongKey := generateDistinctRSAKey(t)
 	signingKeyPath := writeKeyFile(t, signingKey)
 	wrongKeyPath := writeKeyFile(t, wrongKey)
 	claims := jwt.MapClaims{"sub": "override-test"}
@@ -1107,7 +993,7 @@ func TestRun_KeyFlagOverridesEnvVar(t *testing.T) {
 // flags the process-list exposure that inline key material carries.
 func TestRun_KeyInterpretationHint(t *testing.T) {
 	secret := []byte("a-32-byte-symmetric-test-secret!")
-	token := signHS256(t, secret, jwt.MapClaims{"sub": "hint"})
+	token := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "hint"})
 
 	tests := []struct {
 		name       string
@@ -1190,7 +1076,7 @@ func TestRun_KeyInterpretationHint(t *testing.T) {
 
 func TestRun_InvalidSignatureReturnsErrorWithoutUsage(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKeyPath := writeKeyFile(t, generateRSAKey(t))
+	wrongKeyPath := writeKeyFile(t, generateDistinctRSAKey(t))
 	token := signJWT(t, signingKey, jwt.MapClaims{"sub": "test"})
 
 	rootCmd := newRootCommand()
diff --git a/output.go b/output.go
index 0b5b2dd..0d25f45 100644
--- a/output.go
+++ b/output.go
@@ -57,32 +57,24 @@ func printDecryptedPayload(w io.Writer, f *prettyjson.Formatter, plaintext []byt
 	}
 
 	// Check if the decrypted payload is a nested JWT.
-	if strings.Count(text, ".") == 2 {
+	if isJWT(text) {
 		var nested bytes.Buffer
 		if err := decodeAndPrint(&nested, text, ""); err == nil {
 			return printNestedPayload(w, "Decrypted Payload (nested JWT)", nested.Bytes())
 		}
 	}
 
-	// Try to parse as JSON object and pretty-print.
-	var data map[string]any
-	if err := decodeJSON(plaintext, &data); err == nil {
-		formatTimestamps(data)
-		return printSection(w, f, "Decrypted Payload", data)
-	}
-
-	// Try to parse as JSON array and pretty-print.
-	var arr []any
-	if err := decodeJSON(plaintext, &arr); err == nil {
-		if _, err := labelColor.Fprintln(w, "Decrypted Payload"); err != nil {
-			return err
+	// Pretty-print JSON objects and arrays. The payload is decoded once and
+	// dispatched on the decoded value, rather than re-parsing per shape.
+	var value any
+	if err := decodeJSON(plaintext, &value); err == nil {
+		switch v := value.(type) {
+		case map[string]any:
+			formatTimestamps(v)
+			return printSection(w, f, "Decrypted Payload", v)
+		case []any:
+			return printSection(w, f, "Decrypted Payload", v)
 		}
-		pretty, err := f.Marshal(arr)
-		if err != nil {
-			return fmt.Errorf("formatting Decrypted Payload: %w", err)
-		}
-		_, err = fmt.Fprintln(w, escapeFormattedJSONControls(pretty))
-		return err
 	}
 
 	// Fall back to raw text output.
@@ -95,6 +87,7 @@ func printDecryptedPayload(w io.Writer, f *prettyjson.Formatter, plaintext []byt
 
 func escapeTerminalText(text []byte) string {
 	var escaped strings.Builder
+	escaped.Grow(len(text))
 	for len(text) > 0 {
 		r, size := utf8.DecodeRune(text)
 		if r == utf8.RuneError && size == 1 {
@@ -121,10 +114,15 @@ func escapeTerminalText(text []byte) string {
 }
 
 func escapeFormattedJSONControls(text []byte) string {
+	if !bytes.ContainsFunc(text, needsJSONEscape) {
+		return string(text)
+	}
+
 	var escaped strings.Builder
+	escaped.Grow(len(text))
 	for len(text) > 0 {
 		r, size := utf8.DecodeRune(text)
-		if r == 0x7f || (r >= 0x80 && r <= 0x9f) || isBidiControl(r) {
+		if needsJSONEscape(r) {
 			fmt.Fprintf(&escaped, `\u%04x`, r)
 		} else {
 			escaped.Write(text[:size])
@@ -134,6 +132,12 @@ func escapeFormattedJSONControls(text []byte) string {
 	return escaped.String()
 }
 
+// needsJSONEscape reports whether a rune must be escaped in already-formatted
+// JSON: DEL, the C1 controls, and the targeted bidi controls.
+func needsJSONEscape(r rune) bool {
+	return r == 0x7f || (r >= 0x80 && r <= 0x9f) || isBidiControl(r)
+}
+
 func isBidiControl(r rune) bool {
 	return r == 0x061c || r == 0x200e || r == 0x200f ||
 		(r >= 0x202a && r <= 0x202e) || (r >= 0x2066 && r <= 0x2069)
@@ -170,6 +174,9 @@ func formatTimestamps(data map[string]any) {
 			continue
 		}
 
+		// A json.Number can be constructed with arbitrary text, so the value
+		// is re-validated as a JSON number literal here: big.Rat.SetString
+		// also accepts forms JSON does not (ratios, hex, binary exponents).
 		if len(text) == 0 || (text[0] != '-' && (text[0] < '0' || text[0] > '9')) || !json.Valid([]byte(text)) {
 			continue
 		}
@@ -245,7 +252,7 @@ func humanizeDuration(d time.Duration) string {
 }
 
 // printSection outputs a labeled, pretty-printed JSON section.
-func printSection(w io.Writer, f *prettyjson.Formatter, label string, data map[string]any) error {
+func printSection(w io.Writer, f *prettyjson.Formatter, label string, data any) error {
 	if _, err := labelColor.Fprintln(w, label); err != nil {
 		return err
 	}
@@ -258,6 +265,25 @@ func printSection(w io.Writer, f *prettyjson.Formatter, label string, data map[s
 	return err
 }
 
+// printVerdict renders a "<label>: VALID" / "<label>: INVALID" line, with the
+// reason dimmed beneath a failure. The signature and claim checks are
+// independent verdicts (see AGENTS.md) but share this rendering, so they cannot
+// drift apart visually.
+func printVerdict(w io.Writer, label string, valid bool, reason string) error {
+	// The newline stays outside the colored region: Fprintln wraps the text
+	// and appends the newline after the reset, so output truncated at the line
+	// break cannot leave the attribute active in the terminal.
+	if valid {
+		_, err := color.New(color.FgGreen, color.Bold).Fprintln(w, label+": VALID")
+		return err
+	}
+	if _, err := color.New(color.FgRed, color.Bold).Fprintln(w, label+": INVALID"); err != nil {
+		return err
+	}
+	_, err := dimColor.Fprintf(w, "  %s\n", reason)
+	return err
+}
+
 // printSignature outputs the raw signature string in dimmed text.
 func printSignature(w io.Writer, sig string) error {
 	if _, err := labelColor.Fprintln(w, "Signature"); err != nil {
diff --git a/output_test.go b/output_test.go
index a659b4d..11c0c13 100644
--- a/output_test.go
+++ b/output_test.go
@@ -100,15 +100,6 @@ func TestEscapeFormattedJSONControls(t *testing.T) {
 
 // --- formatTimestamps --------------------------------------------------------
 
-// pinTime fixes timeNow for the duration of a test so the expired /
-// not-yet-valid annotations are deterministic regardless of the wall clock.
-func pinTime(t *testing.T, unix int64) {
-	t.Helper()
-	prev := timeNow
-	timeNow = func() time.Time { return time.Unix(unix, 0) }
-	t.Cleanup(func() { timeNow = prev })
-}
-
 func TestFormatTimestamps_AllTimestampFields(t *testing.T) {
 	// Pin now to nbf's instant: nbf is already valid (no note) and exp is in the
 	// future, so exp carries an "expires in" note while iat/nbf are bare.