From fa598c0a6ccd7a1db5539a5c5b69a59248013376 Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 21:09:14 +0200
Subject: [PATCH 1/6] refactor: remove duplicated logic across decode, key, and
 output paths

Extract parseAnyDER for the DER parser cascade that was written out twice,
and drop parseKeyData's unreachable SSH branch so unsupportedKeyError is the
only place that phrases a rejection.

Share the JWE part splitting and sizing between the human and --json paths,
collapse printEncryptedParts' four copy-pasted blocks into a loop, and add
printVerdict for the VALID/INVALID rendering the signature and claim checks
had in duplicate. The verdicts stay independent; only the rendering is shared.

Decode the decrypted payload once and type-switch instead of attempting an
object parse and then an array parse, widening printSection to any so the
array case stops re-implementing it. Add isJWT next to isJWE so token-shape
dispatch has one definition per form, and give the escape helpers a fast
path so unescaped output allocates nothing.

In tests, delete signHS256 (a twin of signJWTWithHMAC), collapse six
near-identical "unparseable key must not become an HMAC secret" tests into
one table keeping every input, and move the cross-file pinTime and
decodeJWTJSONMap fixtures into helpers_test.go per AGENTS.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 AGENTS.md       |   8 +--
 claims.go       |  12 ++--
 claims_test.go  |  20 +++---
 helpers_test.go |  42 +++++++++----
 jsonout.go      |   4 +-
 jsonout_test.go |  18 +-----
 jwe.go          |  49 +++++++++------
 keys.go         |  65 +++++++++-----------
 main.go         |   8 +--
 main_test.go    | 157 ++++++++----------------------------------------
 output.go       |  65 +++++++++++++-------
 output_test.go  |   9 ---
 12 files changed, 179 insertions(+), 278 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 8ebe883..c3c511d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,13 +36,13 @@ All functionality lives in package `main`, split across six source files:
 
 ### `jwe.go` - JWE parsing and decryption
 
-- `isJWE()` - Detects JWE compact serialization (5 dot-separated parts vs. 3 for a JWT)
+- `isJWE()` / `isJWT()` - Detect JWE (5 dot-separated parts) and JWS/JWT (3 parts) compact serialization. Every token-shape dispatch goes through one of these two, so the shape rules are not restated inline
 - `decodeAndPrintJWE()` / `jweProtectedHeaderMap()` - Parse a JWE with `go-jose` and decode every field in the compact protected header for display; without a key print encrypted part metadata, with a key decrypt and print the payload
-- `printEncryptedParts()` / `partSize()` - Encrypted part metadata shown when no key is provided
+- `jweEncryptedParts()` / `printEncryptedParts()` / `partSize()` - Encrypted part metadata shown when no key is provided. `jweEncryptedParts` splits the compact serialization into its five segments for both the human and `--json` paths; `partSize` renders `base64URLLen`'s count (or its `-1`) as display text, so measuring and formatting are not implemented twice
 
 ### `keys.go` - Key loading and format detection
 
-- `loadKey()` / `loadKeyForKID()` / `parseKeyData()` / `parseDERKey()` / `parseJWK()` - Resolve `raw:<secret>` and `hmac:<file>`, then an existing file path, then base64/base64url; parse loaded data as JWK/JWK Set, PEM, or DER (PKCS#1/PKCS#8/SEC 1/PKIX) keys and X.509 certificates, and error on anything else; trim trailing newlines only for ASCII `hmac:` files limited to printable bytes plus tab/CR/LF, while UTF-8/non-ASCII and other binary files remain byte-exact. `loadKeyForKID` threads the token's `kid` so a JWK Set selects the matching entry (`loadKey` is the `kid=""` wrapper); a `kid` that matches nothing returns the `errKIDNotFound` sentinel, which short-circuits the base64/unsupported-format fallbacks so a JWK Set miss fails closed with a clear message instead of degrading into other key material
+- `loadKey()` / `loadKeyForKID()` / `parseKeyData()` / `parseAnyDER()` / `parseDERKey()` / `parseJWK()` - Resolve `raw:<secret>` and `hmac:<file>`, then an existing file path, then base64/base64url; parse loaded data as JWK/JWK Set, PEM, or DER (PKCS#1/PKCS#8/SEC 1/PKIX) keys and X.509 certificates, and error on anything else. `parseAnyDER` holds the one list of understood DER encodings, used both for raw DER and as `parseDERKey`'s fallback for an unrecognized PEM block type, so a format cannot be added to one and missed by the other. `parseKeyData` only detects formats: it never phrases a rejection, because `unsupportedKeyError` is the single place that knows the user-facing subject and the symmetric-form hint. Trailing newlines are trimmed only for ASCII `hmac:` files limited to printable bytes plus tab/CR/LF, while UTF-8/non-ASCII and other binary files remain byte-exact. `loadKeyForKID` threads the token's `kid` so a JWK Set selects the matching entry (`loadKey` is the `kid=""` wrapper); a `kid` that matches nothing returns the `errKIDNotFound` sentinel, which short-circuits the base64/unsupported-format fallbacks so a JWK Set miss fails closed with a clear message instead of degrading into other key material
 - `unsupportedKeyError()` - Explains a rejection and names the explicit symmetric form to use, substituting the user's own path so the fix is copy-pasteable; SSH keys get a conversion hint instead
 - `classifyKeyArg()` - Reports which reading `loadKey` will apply (`raw:` literal, `hmac:` secret file, existing file, base64, or unusable), mirroring its precedence so the CLI hint cannot drift from actual behavior; uses `Stat` rather than a read, so classifying never consumes the key source
 - `decodeBase64Key()` / `symmetricKey()` - Decode whitespace-tolerant base64/base64url key material (applied to text key files as well as inline arguments, so the same bytes mean the same key either way) and gate symmetric secrets, rejecting empty key material
@@ -57,7 +57,7 @@ Removing the fallback deleted the heuristics that existed only to decide it (`is
 - `printDecryptedPayload()` / `escapeTerminalText()` / `escapeFormattedJSONControls()` - Recursively decode nested JWTs/JWEs and pretty-print JSON objects or arrays; raw plaintext escapes C0 controls except newline/tab, DEL, C1 controls, invalid UTF-8 bytes, and targeted bidi controls, while formatted JSON sanitizes C1, DEL, and the same targeted bidi controls
 - `formatTimestamps()` / `timestampStatus()` / `humanizeDuration()` - Convert exact `iat`, `exp`, `nbf` Unix numeric values, including fractions, to RFC3339 strings (original value shown in parentheses); `exp` is annotated with the time remaining or elapsed (`expires in 14m` / `expired 2h ago`) and a future `nbf` with `not yet valid, in 5m` (an already-valid `nbf` gets no note). `humanizeDuration` renders the largest whole unit (s/m/h/d), truncating toward zero for deterministic output. This is display-only and never affects verification or the exit code; `timeNow` is a package variable so the annotations are testable. The `--json` path skips this entirely and keeps raw numeric claims
 - `newFormatter()` - Creates a `go-prettyjson` formatter with the project color scheme
-- `printSection()` / `printSignature()` - Formatted output using `fatih/color`
+- `printSection()` / `printSignature()` / `printVerdict()` - Formatted output using `fatih/color`. `printSection` takes any JSON-marshalable value, so objects and arrays share one path; `printVerdict` renders the `<label>: VALID`/`INVALID` line with its dim reason, shared by the independent signature and claim verdicts so they cannot drift apart visually
 
 ### Release packaging
 
diff --git a/claims.go b/claims.go
index 1e8fabc..fc5526a 100644
--- a/claims.go
+++ b/claims.go
@@ -6,7 +6,6 @@ import (
 	"io"
 	"strings"
 
-	"github.com/fatih/color"
 	"github.com/golang-jwt/jwt/v5"
 )
 
@@ -66,16 +65,13 @@ func verifyClaims(w io.Writer, tokenStr string, c claimChecks) error {
 
 	valid, reason := validateClaimsSet(claims, c)
 	if !valid {
-		if _, werr := color.New(color.FgRed, color.Bold).Fprintln(w, "Claims: INVALID"); werr != nil {
+		text := claimReason(reason)
+		if werr := printVerdict(w, "Claims", false, text); werr != nil {
 			return werr
 		}
-		if _, werr := dimColor.Fprintf(w, "  %s\n", claimReason(reason)); werr != nil {
-			return werr
-		}
-		return fmt.Errorf("%w: %s", errInvalidClaims, claimReason(reason))
+		return fmt.Errorf("%w: %s", errInvalidClaims, text)
 	}
-	_, werr := color.New(color.FgGreen, color.Bold).Fprintln(w, "Claims: VALID")
-	return werr
+	return printVerdict(w, "Claims", true, "")
 }
 
 // claimReason flattens a validation error onto a single line. The jwt validator
diff --git a/claims_test.go b/claims_test.go
index 34d8dd1..204ef15 100644
--- a/claims_test.go
+++ b/claims_test.go
@@ -130,7 +130,7 @@ func TestValidateClaimsSet(t *testing.T) {
 
 func TestVerifyClaims_ValidPrintsAndReturnsNil(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 
 	var buf bytes.Buffer
 	if err := verifyClaims(&buf, token, claimChecks{verify: true}); err != nil {
@@ -143,7 +143,7 @@ func TestVerifyClaims_ValidPrintsAndReturnsNil(t *testing.T) {
 
 func TestVerifyClaims_InvalidReturnsSentinelAndReason(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	err := verifyClaims(&buf, token, claimChecks{verify: true})
@@ -185,7 +185,7 @@ func TestClaimReason_FlattensJoinedErrors(t *testing.T) {
 
 func TestDecodeJWTHuman_NoClaimSectionWhenNotRequested(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	if err := decodeJWTHuman(&buf, token, "", claimChecks{}); err != nil {
@@ -198,7 +198,7 @@ func TestDecodeJWTHuman_NoClaimSectionWhenNotRequested(t *testing.T) {
 
 func TestDecodeJWTHuman_ClaimsSectionAfterSignature(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 
 	var buf bytes.Buffer
 	if err := decodeJWTHuman(&buf, token, "raw:secret", claimChecks{verify: true}); err != nil {
@@ -217,7 +217,7 @@ func TestDecodeJWTHuman_ClaimsSectionAfterSignature(t *testing.T) {
 
 func TestDecodeJWTHuman_ValidSignatureInvalidClaims(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	err := decodeJWTHuman(&buf, token, "raw:secret", claimChecks{verify: true})
@@ -232,7 +232,7 @@ func TestDecodeJWTHuman_ValidSignatureInvalidClaims(t *testing.T) {
 
 func TestDecodeJWTHuman_InvalidSignatureStillShowsClaims(t *testing.T) {
 	pinTime(t, 1000)
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 
 	var buf bytes.Buffer
 	// Wrong key: the signature is invalid, but the claims are still live.
@@ -252,7 +252,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 	pinTime(t, 1000)
 
 	t.Run("valid", func(t *testing.T) {
-		token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+		token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 		var buf bytes.Buffer
 		if err := decodeJWTJSON(&buf, token, "", claimChecks{verify: true}); err != nil {
 			t.Fatalf("unexpected error: %v", err)
@@ -263,7 +263,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 	})
 
 	t.Run("expired emits json then sentinel", func(t *testing.T) {
-		token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+		token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 		var buf bytes.Buffer
 		err := decodeJWTJSON(&buf, token, "", claimChecks{verify: true})
 		if !errors.Is(err, errInvalidClaims) {
@@ -275,7 +275,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 	})
 
 	t.Run("not requested omits field", func(t *testing.T) {
-		token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
+		token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(2000)})
 		var buf bytes.Buffer
 		if err := decodeJWTJSON(&buf, token, "", claimChecks{}); err != nil {
 			t.Fatalf("unexpected error: %v", err)
@@ -289,7 +289,7 @@ func TestDecodeJWTJSON_ClaimsValidField(t *testing.T) {
 func TestDecodeJWTJSON_SignatureTakesPrecedenceOverClaims(t *testing.T) {
 	pinTime(t, 1000)
 	// Expired claims and a wrong key: both checks fail.
-	token := signHS256(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
+	token := signJWTWithHMAC(t, []byte("secret"), jwt.MapClaims{"exp": float64(500)})
 
 	var buf bytes.Buffer
 	err := decodeJWTJSON(&buf, token, "raw:wrong-secret", claimChecks{verify: true})
diff --git a/helpers_test.go b/helpers_test.go
index 5106089..2b2547c 100644
--- a/helpers_test.go
+++ b/helpers_test.go
@@ -11,6 +11,7 @@ import (
 	"crypto/x509/pkix"
 	"encoding/base64"
 	"encoding/binary"
+	"encoding/json"
 	"encoding/pem"
 	"fmt"
 	"math/big"
@@ -301,7 +302,10 @@ func signJWT(t *testing.T, key *rsa.PrivateKey, claims jwt.MapClaims) string {
 	return signed
 }
 
-// signJWTWithHMAC creates a signed JWT using HMAC-SHA256 with the given symmetric key.
+// signJWTWithHMAC creates a signed JWT using HMAC-SHA256 with the given
+// symmetric key. It also stands in for an attacker who knows the bytes of a
+// published key file, in the tests that assert such material is never accepted
+// as an HMAC secret.
 func signJWTWithHMAC(t *testing.T, key []byte, claims jwt.MapClaims) string {
 	t.Helper()
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
@@ -388,17 +392,6 @@ func writeTextKeyFile(t *testing.T, name, contents string) string {
 	return path
 }
 
-// signHS256 signs a token with an HMAC secret, standing in for an attacker who
-// knows the bytes of a published key file.
-func signHS256(t *testing.T, secret []byte, claims jwt.MapClaims) string {
-	t.Helper()
-	token, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(secret)
-	if err != nil {
-		t.Fatalf("signing HS256 token: %v", err)
-	}
-	return token
-}
-
 func signJWTWithEd25519(t *testing.T, key ed25519.PrivateKey, claims jwt.MapClaims) string {
 	t.Helper()
 	token := jwt.NewWithClaims(jwt.SigningMethodEdDSA, claims)
@@ -408,3 +401,28 @@ func signJWTWithEd25519(t *testing.T, key ed25519.PrivateKey, claims jwt.MapClai
 	}
 	return signed
 }
+
+// pinTime fixes timeNow for the duration of a test so the expired /
+// not-yet-valid annotations are deterministic regardless of the wall clock.
+func pinTime(t *testing.T, unix int64) {
+	t.Helper()
+	prev := timeNow
+	timeNow = func() time.Time { return time.Unix(unix, 0) }
+	t.Cleanup(func() { timeNow = prev })
+}
+
+// decodeJWTJSONMap runs decodeJWTJSON and returns the parsed object plus the
+// error, so tests can assert on both the shape and the exit-driving error.
+func decodeJWTJSONMap(t *testing.T, token, key string) (map[string]any, error) {
+	t.Helper()
+	var buf bytes.Buffer
+	err := decodeJWTJSON(&buf, token, key, claimChecks{})
+
+	var out map[string]any
+	dec := json.NewDecoder(bytes.NewReader(buf.Bytes()))
+	dec.UseNumber()
+	if derr := dec.Decode(&out); derr != nil {
+		t.Fatalf("output is not valid JSON: %v\n%s", derr, buf.String())
+	}
+	return out, err
+}
diff --git a/jsonout.go b/jsonout.go
index a9c35ab..3a13ad2 100644
--- a/jsonout.go
+++ b/jsonout.go
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"strings"
 
 	"github.com/go-jose/go-jose/v4"
 )
@@ -97,8 +96,7 @@ func decodeJWEJSON(w io.Writer, tokenStr, keyStr string) error {
 	out := jweJSON{ProtectedHeader: header}
 
 	if keyStr == "" {
-		parts := strings.SplitN(tokenStr, ".", 5)
-		if len(parts) == 5 {
+		if parts, ok := jweEncryptedParts(tokenStr); ok {
 			out.Encrypted = &jweEncrypted{
 				EncryptedKeyBytes: base64URLLen(parts[1]),
 				IVBytes:           base64URLLen(parts[2]),
diff --git a/jsonout_test.go b/jsonout_test.go
index 449b2a9..265912a 100644
--- a/jsonout_test.go
+++ b/jsonout_test.go
@@ -11,22 +11,6 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 )
 
-// decodeJWTJSONMap runs decodeJWTJSON and returns the parsed object plus the
-// error, so tests can assert on both the shape and the exit-driving error.
-func decodeJWTJSONMap(t *testing.T, token, key string) (map[string]any, error) {
-	t.Helper()
-	var buf bytes.Buffer
-	err := decodeJWTJSON(&buf, token, key, claimChecks{})
-
-	var out map[string]any
-	dec := json.NewDecoder(bytes.NewReader(buf.Bytes()))
-	dec.UseNumber()
-	if derr := dec.Decode(&out); derr != nil {
-		t.Fatalf("output is not valid JSON: %v\n%s", derr, buf.String())
-	}
-	return out, err
-}
-
 func TestDecodeJWTJSON_NoKeyOmitsSignatureValid(t *testing.T) {
 	token := makeJWT(`{"alg":"HS256"}`, `{"sub":"abc","exp":1516239022}`, "sig")
 
@@ -63,7 +47,7 @@ func TestDecodeJWTJSON_PreservesLargeIntegerExactly(t *testing.T) {
 
 func TestDecodeJWTJSON_ValidSignature(t *testing.T) {
 	secret := []byte("a-random-looking-test-key-with-32b")
-	token := signHS256(t, secret, jwt.MapClaims{"sub": "abc"})
+	token := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "abc"})
 
 	out, err := decodeJWTJSONMap(t, token, "raw:"+string(secret))
 	if err != nil {
diff --git a/jwe.go b/jwe.go
index f06108d..2159a17 100644
--- a/jwe.go
+++ b/jwe.go
@@ -47,6 +47,13 @@ func isJWE(token string) bool {
 	return strings.Count(token, ".") == 4
 }
 
+// isJWT returns true if the token string looks like a JWS/JWT compact
+// serialization (3 dot-separated parts). It is the counterpart of isJWE, so
+// token-shape dispatch has one definition per form.
+func isJWT(token string) bool {
+	return strings.Count(token, ".") == 2
+}
+
 // decodeAndPrintJWE parses a JWE token and prints its contents.
 // If keyStr is provided, the token is decrypted and the plaintext payload is displayed.
 // Otherwise, only the protected header and encrypted part metadata are shown.
@@ -112,27 +119,33 @@ func jweProtectedHeaderMap(token string) (map[string]any, error) {
 	return header, nil
 }
 
+// jweEncryptedParts splits a JWE compact serialization into its five segments,
+// reporting false when the token does not have them. Both output paths measure
+// the same segments, so the shape rule lives in one place.
+func jweEncryptedParts(tokenStr string) ([]string, bool) {
+	parts := strings.SplitN(tokenStr, ".", 5)
+	return parts, len(parts) == 5
+}
+
 // printEncryptedParts displays metadata about the encrypted JWE parts.
 func printEncryptedParts(w io.Writer, tokenStr string) error {
-	parts := strings.SplitN(tokenStr, ".", 5)
-	if len(parts) != 5 {
+	parts, ok := jweEncryptedParts(tokenStr)
+	if !ok {
 		return nil
 	}
 
 	if _, err := labelColor.Fprintln(w, "Encrypted Content"); err != nil {
 		return err
 	}
-	if _, err := dimColor.Fprintf(w, "Encrypted Key : %s\n", partSize(parts[1])); err != nil {
-		return err
-	}
-	if _, err := dimColor.Fprintf(w, "IV            : %s\n", partSize(parts[2])); err != nil {
-		return err
-	}
-	if _, err := dimColor.Fprintf(w, "Ciphertext    : %s\n", partSize(parts[3])); err != nil {
-		return err
-	}
-	if _, err := dimColor.Fprintf(w, "Auth Tag      : %s\n", partSize(parts[4])); err != nil {
-		return err
+	for _, part := range []struct{ label, segment string }{
+		{"Encrypted Key", parts[1]},
+		{"IV", parts[2]},
+		{"Ciphertext", parts[3]},
+		{"Auth Tag", parts[4]},
+	} {
+		if _, err := dimColor.Fprintf(w, "%-14s: %s\n", part.label, partSize(part.segment)); err != nil {
+			return err
+		}
 	}
 	if _, err := fmt.Fprintln(w); err != nil {
 		return err
@@ -141,12 +154,12 @@ func printEncryptedParts(w io.Writer, tokenStr string) error {
 	return err
 }
 
-// partSize describes the decoded byte length of a base64url-encoded JWE part,
-// flagging parts that are not valid base64url instead of reporting 0 bytes.
+// partSize renders the decoded byte length reported by base64URLLen, flagging
+// parts that are not valid base64url instead of reporting 0 bytes.
 func partSize(s string) string {
-	data, err := base64.RawURLEncoding.DecodeString(s)
-	if err != nil {
+	n := base64URLLen(s)
+	if n < 0 {
 		return "invalid base64url"
 	}
-	return fmt.Sprintf("%d bytes", len(data))
+	return fmt.Sprintf("%d bytes", n)
 }
diff --git a/keys.go b/keys.go
index 2f37b09..9d18db3 100644
--- a/keys.go
+++ b/keys.go
@@ -263,35 +263,40 @@ func parseKeyData(data []byte, kid string) (any, error) {
 		return parseDERKey(block.Bytes, block.Type)
 	}
 
-	// Try raw DER parsing (private keys).
-	if key, err := x509.ParsePKCS8PrivateKey(data); err == nil {
+	// Try raw DER parsing.
+	if key, ok := parseAnyDER(data); ok {
 		return key, nil
 	}
-	if key, err := x509.ParsePKCS1PrivateKey(data); err == nil {
-		return key, nil
+
+	// The rejection is phrased by unsupportedKeyError, which is the single
+	// place that knows the user-facing subject and the symmetric-form hint.
+	return nil, fmt.Errorf("unrecognized key format")
+}
+
+// parseAnyDER tries every supported DER encoding, private keys first and then
+// public ones, reporting whether any of them accepted the bytes. It backs both
+// the raw-DER path and the fallback for an unrecognized PEM block type, so the
+// set of understood encodings is defined once.
+func parseAnyDER(der []byte) (any, bool) {
+	if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
+		return key, true
 	}
-	if key, err := x509.ParseECPrivateKey(data); err == nil {
-		return key, nil
+	if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
+		return key, true
 	}
-
-	// Try raw DER parsing (public keys).
-	if key, err := x509.ParsePKIXPublicKey(data); err == nil {
-		return key, nil
+	if key, err := x509.ParseECPrivateKey(der); err == nil {
+		return key, true
 	}
-	if key, err := x509.ParsePKCS1PublicKey(data); err == nil {
-		return key, nil
+	if key, err := x509.ParsePKIXPublicKey(der); err == nil {
+		return key, true
 	}
-	if cert, err := x509.ParseCertificate(data); err == nil {
-		return cert.PublicKey, nil
+	if key, err := x509.ParsePKCS1PublicKey(der); err == nil {
+		return key, true
 	}
-
-	if isSSHPublicKey(data) {
-		// ssh-keygen's PKCS8 export covers RSA and ECDSA keys only, so the
-		// hint does not promise it for Ed25519.
-		return nil, fmt.Errorf("SSH public key format is not supported; supply the key as PEM, DER, or JWK (for RSA and ECDSA keys: ssh-keygen -e -m PKCS8 -f <key>)")
+	if cert, err := x509.ParseCertificate(der); err == nil {
+		return cert.PublicKey, true
 	}
-
-	return nil, fmt.Errorf("unrecognized key format")
+	return nil, false
 }
 
 // parseDERKey parses DER-encoded key bytes based on the PEM block type.
@@ -315,25 +320,9 @@ func parseDERKey(der []byte, blockType string) (any, error) {
 		}
 		return cert.PublicKey, nil
 	default:
-		// Try all parsers (private keys first, then public).
-		if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
+		if key, ok := parseAnyDER(der); ok {
 			return key, nil
 		}
-		if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
-			return key, nil
-		}
-		if key, err := x509.ParseECPrivateKey(der); err == nil {
-			return key, nil
-		}
-		if key, err := x509.ParsePKIXPublicKey(der); err == nil {
-			return key, nil
-		}
-		if key, err := x509.ParsePKCS1PublicKey(der); err == nil {
-			return key, nil
-		}
-		if cert, err := x509.ParseCertificate(der); err == nil {
-			return cert.PublicKey, nil
-		}
 		return nil, fmt.Errorf("unable to parse key from PEM block type %q", blockType)
 	}
 }
diff --git a/main.go b/main.go
index 3cae41e..02722ee 100644
--- a/main.go
+++ b/main.go
@@ -317,16 +317,12 @@ func verifySignature(w io.Writer, tokenStr, keyStr string) error {
 	}
 
 	if !valid {
-		if _, werr := color.New(color.FgRed, color.Bold).Fprintln(w, "Signature: INVALID"); werr != nil {
-			return werr
-		}
-		if _, werr := dimColor.Fprintf(w, "  %v\n", reason); werr != nil {
+		if werr := printVerdict(w, "Signature", false, reason.Error()); werr != nil {
 			return werr
 		}
 		return fmt.Errorf("%w: %v", errInvalidSignature, reason)
 	}
-	_, werr := color.New(color.FgGreen, color.Bold).Fprintln(w, "Signature: VALID")
-	return werr
+	return printVerdict(w, "Signature", true, "")
 }
 
 // verifyJWTSignature performs the cryptographic signature check and reports the
diff --git a/main_test.go b/main_test.go
index c432992..5888942 100644
--- a/main_test.go
+++ b/main_test.go
@@ -574,7 +574,7 @@ func TestVerifySignature_RejectsForgedHMACFromPublishedKeyFile(t *testing.T) {
 			// The attacker signs with exactly what the victim's key file
 			// holds, trailing newline trimmed as jwtd trims it.
 			secret := []byte(strings.TrimRight(tt.contents, "\n"))
-			forged := signHS256(t, secret, jwt.MapClaims{"sub": "attacker", "role": "admin"})
+			forged := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "attacker", "role": "admin"})
 
 			var buf bytes.Buffer
 			err := verifySignature(&buf, forged, keyPath)
@@ -711,152 +711,45 @@ func TestDecodeAndPrint_CertificateCannotBecomeHMACSecret(t *testing.T) {
 	}
 }
 
-func TestDecodeAndPrint_RejectsBOMPrefixedPublicJWKAsHMACSecret(t *testing.T) {
+// TestDecodeAndPrint_UnparseableKeyNeverBecomesHMACSecret pins the post-5.0.0
+// property that key material jwtd cannot parse is rejected outright rather than
+// falling back to an HMAC secret. Each row signs a token with the key bytes
+// themselves, which is exactly what an attacker who knows a published key can
+// do, and asserts the signature is never reported valid. The rows are the
+// inputs that reached the old fallback through its various heuristics; the
+// heuristics are gone, so they share one body.
+func TestDecodeAndPrint_UnparseableKeyNeverBecomesHMACSecret(t *testing.T) {
 	rsaKey := generateRSAKey(t)
-	jwkData, err := json.Marshal(jose.JSONWebKey{Key: &rsaKey.PublicKey})
+	publicJWK, err := json.Marshal(jose.JSONWebKey{Key: &rsaKey.PublicKey})
 	if err != nil {
 		t.Fatalf("marshaling public JWK: %v", err)
 	}
-	jwkData = append([]byte{0xef, 0xbb, 0xbf}, jwkData...)
-	keyPath := filepath.Join(t.TempDir(), "public.jwk")
-	if err := os.WriteFile(keyPath, jwkData, 0600); err != nil {
-		t.Fatalf("writing public JWK: %v", err)
-	}
-	token := signJWTWithHMAC(t, jwkData, jwt.MapClaims{"sub": "test"})
-
-	var buf bytes.Buffer
-	if err := decodeAndPrint(&buf, token, keyPath); err == nil {
-		t.Fatalf("expected BOM-prefixed public JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-	}
-	if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-		t.Fatalf("public JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-	}
-}
-
-func TestDecodeAndPrint_RejectsEscapedJWKMemberAsHMACSecret(t *testing.T) {
-	jwkData := []byte(`{"\u006bty":"oct","k":`)
-	keyPath := filepath.Join(t.TempDir(), "malformed.jwk")
-	if err := os.WriteFile(keyPath, jwkData, 0600); err != nil {
-		t.Fatalf("writing malformed JWK: %v", err)
-	}
-	token := signJWTWithHMAC(t, jwkData, jwt.MapClaims{"sub": "test"})
+	bomPublicJWK := append([]byte{0xef, 0xbb, 0xbf}, publicJWK...)
 
-	var buf bytes.Buffer
-	if err := decodeAndPrint(&buf, token, keyPath); err == nil {
-		t.Fatalf("expected escaped JWK member to be rejected, got output:\n%s", stripANSI(buf.String()))
-	}
-	if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-		t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-	}
-}
-
-func TestDecodeAndPrint_RejectsLaterMalformedJWKMembersAsHMACSecrets(t *testing.T) {
 	tests := []struct {
 		name string
 		data []byte
 	}{
+		{name: "BOM-prefixed public JWK", data: bomPublicJWK},
+		{name: "escaped JWK member", data: []byte(`{"\u006bty":"oct","k":`)},
 		{name: "literal kty after malformed value", data: []byte(`{"bad":truX,"kty":"RSA","n":"public"}`)},
 		{name: "escaped kty after malformed value", data: []byte(`{"bad":truX,"\u006bty":"RSA","n":"public"}`)},
 		{name: "later keys", data: []byte(`{"bad":truX,"keys":[`)},
 		{name: "kty truncated before colon", data: []byte(`{"bad":truX,"kty"`)},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			keyPath := filepath.Join(t.TempDir(), "malformed.jwk")
-			if err := os.WriteFile(keyPath, tt.data, 0600); err != nil {
-				t.Fatalf("writing malformed JWK: %v", err)
-			}
-			token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
-
-			var buf bytes.Buffer
-			if err := decodeAndPrint(&buf, token, keyPath); err == nil {
-				t.Fatalf("expected malformed JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-			}
-			if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-				t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrint_RejectsMissingCommaJWKMembersAsHMACSecrets(t *testing.T) {
-	tests := []struct {
-		name      string
-		data      []byte
-		useBase64 bool
-	}{
-		{name: "literal kty", data: []byte(`{"note":"x" "kty":"RSA","n":"public"}`)},
-		{name: "escaped kty", data: []byte(`{"note":"x" "\u006bty":"RSA","n":"public"}`)},
-		{name: "literal kty at EOF", data: []byte(`{"note":"x" "kty"`)},
-		{name: "escaped keys at EOF after malformed value via base64", data: []byte(`{"bad":truX "\u006b\u0065\u0079\u0073"`), useBase64: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			keyInput := base64.StdEncoding.EncodeToString(tt.data)
-			if !tt.useBase64 {
-				keyInput = filepath.Join(t.TempDir(), "malformed.jwk")
-				if err := os.WriteFile(keyInput, tt.data, 0600); err != nil {
-					t.Fatalf("writing malformed JWK: %v", err)
-				}
-			}
-			token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
-
-			var buf bytes.Buffer
-			if err := decodeAndPrint(&buf, token, keyInput); err == nil {
-				t.Fatalf("expected malformed JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-			}
-			if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-				t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrint_RejectsMalformedJWKMemberSeparatorsAsHMACSecrets(t *testing.T) {
-	tests := []struct {
-		name      string
-		data      []byte
-		useBase64 bool
-	}{
+		{name: "missing comma before literal kty", data: []byte(`{"note":"x" "kty":"RSA","n":"public"}`)},
+		{name: "missing comma before escaped kty", data: []byte(`{"note":"x" "\u006bty":"RSA","n":"public"}`)},
+		{name: "missing comma before literal kty at EOF", data: []byte(`{"note":"x" "kty"`)},
+		{name: "escaped keys at EOF after malformed value", data: []byte(`{"bad":truX "\u006b\u0065\u0079\u0073"`)},
 		{name: "literal kty with missing colon", data: []byte(`{"kty" "RSA","n":"public"}`)},
-		{name: "escaped kty with replaced colon via base64", data: []byte(`{"\u006bty";"RSA","n":"public"}`), useBase64: true},
+		{name: "escaped kty with replaced colon", data: []byte(`{"\u006bty";"RSA","n":"public"}`)},
 		{name: "literal keys with replaced colon", data: []byte(`{"keys"=[{"kty":"RSA"}]}`)},
-		{name: "escaped keys with missing colon via base64", data: []byte(`{"\u006b\u0065\u0079\u0073" [{"kty":"RSA"}]}`), useBase64: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			keyInput := base64.StdEncoding.EncodeToString(tt.data)
-			if !tt.useBase64 {
-				keyInput = filepath.Join(t.TempDir(), "malformed.jwk")
-				if err := os.WriteFile(keyInput, tt.data, 0600); err != nil {
-					t.Fatalf("writing malformed JWK: %v", err)
-				}
-			}
-			token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
-
-			var buf bytes.Buffer
-			if err := decodeAndPrint(&buf, token, keyInput); err == nil {
-				t.Fatalf("expected malformed JWK to be rejected, got output:\n%s", stripANSI(buf.String()))
-			}
-			if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-				t.Fatalf("malformed JWK was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrint_RejectsIncompleteJSONObjectKeysAsHMACSecrets(t *testing.T) {
-	tests := []struct {
-		name string
-		data []byte
-	}{
+		{name: "escaped keys with missing colon", data: []byte(`{"\u006b\u0065\u0079\u0073" [{"kty":"RSA"}]}`)},
 		{name: "truncated kty member", data: []byte(`{"kty`)},
 		{name: "malformed JWK fields without kty", data: []byte(`{"n":"public","e":"AQAB",`)},
 	}
 
+	// Both readings of a key argument reach the same rejection, so every row
+	// runs as a file and as inline base64.
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			for _, mode := range []string{"file", "base64"} {
@@ -865,17 +758,17 @@ func TestDecodeAndPrint_RejectsIncompleteJSONObjectKeysAsHMACSecrets(t *testing.
 					if mode == "file" {
 						keyInput = filepath.Join(t.TempDir(), "malformed.jwk")
 						if err := os.WriteFile(keyInput, tt.data, 0600); err != nil {
-							t.Fatalf("writing malformed JWK: %v", err)
+							t.Fatalf("writing key material: %v", err)
 						}
 					}
 					token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
 
 					var buf bytes.Buffer
 					if err := decodeAndPrint(&buf, token, keyInput); err == nil {
-						t.Fatalf("expected malformed JSON object key to be rejected, got output:\n%s", stripANSI(buf.String()))
+						t.Fatalf("expected unparseable key material to be rejected, got output:\n%s", stripANSI(buf.String()))
 					}
 					if strings.Contains(stripANSI(buf.String()), "Signature: VALID") {
-						t.Fatalf("malformed JSON object key was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
+						t.Fatalf("unparseable key material was accepted as an HMAC secret:\n%s", stripANSI(buf.String()))
 					}
 				})
 			}
@@ -1107,7 +1000,7 @@ func TestRun_KeyFlagOverridesEnvVar(t *testing.T) {
 // flags the process-list exposure that inline key material carries.
 func TestRun_KeyInterpretationHint(t *testing.T) {
 	secret := []byte("a-32-byte-symmetric-test-secret!")
-	token := signHS256(t, secret, jwt.MapClaims{"sub": "hint"})
+	token := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "hint"})
 
 	tests := []struct {
 		name       string
diff --git a/output.go b/output.go
index 0b5b2dd..7f1fd77 100644
--- a/output.go
+++ b/output.go
@@ -57,32 +57,24 @@ func printDecryptedPayload(w io.Writer, f *prettyjson.Formatter, plaintext []byt
 	}
 
 	// Check if the decrypted payload is a nested JWT.
-	if strings.Count(text, ".") == 2 {
+	if isJWT(text) {
 		var nested bytes.Buffer
 		if err := decodeAndPrint(&nested, text, ""); err == nil {
 			return printNestedPayload(w, "Decrypted Payload (nested JWT)", nested.Bytes())
 		}
 	}
 
-	// Try to parse as JSON object and pretty-print.
-	var data map[string]any
-	if err := decodeJSON(plaintext, &data); err == nil {
-		formatTimestamps(data)
-		return printSection(w, f, "Decrypted Payload", data)
-	}
-
-	// Try to parse as JSON array and pretty-print.
-	var arr []any
-	if err := decodeJSON(plaintext, &arr); err == nil {
-		if _, err := labelColor.Fprintln(w, "Decrypted Payload"); err != nil {
-			return err
+	// Pretty-print JSON objects and arrays. The payload is decoded once and
+	// dispatched on the decoded value, rather than re-parsing per shape.
+	var value any
+	if err := decodeJSON(plaintext, &value); err == nil {
+		switch v := value.(type) {
+		case map[string]any:
+			formatTimestamps(v)
+			return printSection(w, f, "Decrypted Payload", v)
+		case []any:
+			return printSection(w, f, "Decrypted Payload", v)
 		}
-		pretty, err := f.Marshal(arr)
-		if err != nil {
-			return fmt.Errorf("formatting Decrypted Payload: %w", err)
-		}
-		_, err = fmt.Fprintln(w, escapeFormattedJSONControls(pretty))
-		return err
 	}
 
 	// Fall back to raw text output.
@@ -95,6 +87,7 @@ func printDecryptedPayload(w io.Writer, f *prettyjson.Formatter, plaintext []byt
 
 func escapeTerminalText(text []byte) string {
 	var escaped strings.Builder
+	escaped.Grow(len(text))
 	for len(text) > 0 {
 		r, size := utf8.DecodeRune(text)
 		if r == utf8.RuneError && size == 1 {
@@ -121,10 +114,15 @@ func escapeTerminalText(text []byte) string {
 }
 
 func escapeFormattedJSONControls(text []byte) string {
+	if !bytes.ContainsFunc(text, needsJSONEscape) {
+		return string(text)
+	}
+
 	var escaped strings.Builder
+	escaped.Grow(len(text))
 	for len(text) > 0 {
 		r, size := utf8.DecodeRune(text)
-		if r == 0x7f || (r >= 0x80 && r <= 0x9f) || isBidiControl(r) {
+		if needsJSONEscape(r) {
 			fmt.Fprintf(&escaped, `\u%04x`, r)
 		} else {
 			escaped.Write(text[:size])
@@ -134,6 +132,12 @@ func escapeFormattedJSONControls(text []byte) string {
 	return escaped.String()
 }
 
+// needsJSONEscape reports whether a rune must be escaped in already-formatted
+// JSON: DEL, the C1 controls, and the targeted bidi controls.
+func needsJSONEscape(r rune) bool {
+	return r == 0x7f || (r >= 0x80 && r <= 0x9f) || isBidiControl(r)
+}
+
 func isBidiControl(r rune) bool {
 	return r == 0x061c || r == 0x200e || r == 0x200f ||
 		(r >= 0x202a && r <= 0x202e) || (r >= 0x2066 && r <= 0x2069)
@@ -170,6 +174,9 @@ func formatTimestamps(data map[string]any) {
 			continue
 		}
 
+		// A json.Number can be constructed with arbitrary text, so the value
+		// is re-validated as a JSON number literal here: big.Rat.SetString
+		// also accepts forms JSON does not (ratios, hex, binary exponents).
 		if len(text) == 0 || (text[0] != '-' && (text[0] < '0' || text[0] > '9')) || !json.Valid([]byte(text)) {
 			continue
 		}
@@ -245,7 +252,7 @@ func humanizeDuration(d time.Duration) string {
 }
 
 // printSection outputs a labeled, pretty-printed JSON section.
-func printSection(w io.Writer, f *prettyjson.Formatter, label string, data map[string]any) error {
+func printSection(w io.Writer, f *prettyjson.Formatter, label string, data any) error {
 	if _, err := labelColor.Fprintln(w, label); err != nil {
 		return err
 	}
@@ -258,6 +265,22 @@ func printSection(w io.Writer, f *prettyjson.Formatter, label string, data map[s
 	return err
 }
 
+// printVerdict renders a "<label>: VALID" / "<label>: INVALID" line, with the
+// reason dimmed beneath a failure. The signature and claim checks are
+// independent verdicts (see AGENTS.md) but share this rendering, so they cannot
+// drift apart visually.
+func printVerdict(w io.Writer, label string, valid bool, reason string) error {
+	if valid {
+		_, err := color.New(color.FgGreen, color.Bold).Fprintf(w, "%s: VALID\n", label)
+		return err
+	}
+	if _, err := color.New(color.FgRed, color.Bold).Fprintf(w, "%s: INVALID\n", label); err != nil {
+		return err
+	}
+	_, err := dimColor.Fprintf(w, "  %s\n", reason)
+	return err
+}
+
 // printSignature outputs the raw signature string in dimmed text.
 func printSignature(w io.Writer, sig string) error {
 	if _, err := labelColor.Fprintln(w, "Signature"); err != nil {
diff --git a/output_test.go b/output_test.go
index a659b4d..11c0c13 100644
--- a/output_test.go
+++ b/output_test.go
@@ -100,15 +100,6 @@ func TestEscapeFormattedJSONControls(t *testing.T) {
 
 // --- formatTimestamps --------------------------------------------------------
 
-// pinTime fixes timeNow for the duration of a test so the expired /
-// not-yet-valid annotations are deterministic regardless of the wall clock.
-func pinTime(t *testing.T, unix int64) {
-	t.Helper()
-	prev := timeNow
-	timeNow = func() time.Time { return time.Unix(unix, 0) }
-	t.Cleanup(func() { timeNow = prev })
-}
-
 func TestFormatTimestamps_AllTimestampFields(t *testing.T) {
 	// Pin now to nbf's instant: nbf is already valid (no note) and exp is in the
 	// future, so exp carries an "expires in" note while iat/nbf are bare.

From 1cb98ce66b9606c6f5465d6d2d8f0a3c250872e8 Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 21:12:39 +0200
Subject: [PATCH 2/6] refactor: parse each token once and give key precedence
 one authority

decodeJWTHuman parsed the token, verifySignature parsed it again, and
verifyClaims a third time, so a single run decoded the same segments up to
four times and built eight maps to show three. parseUnverifiedJWT now returns
a parsedJWT (raw string, token, segments, claims) that is threaded through the
decode, signature, and claim steps; the string-taking verifySignature and
verifyClaims remain as wrappers for callers that hold only the compact token.

The re-parse existed because formatTimestamps rewrites claim values in place,
leaving the parsed map fit only for printing. printParsedJWT now formats a
maps.Clone of the claims, so the parse stays authoritative and reusable.

classifyKeyArg described itself as mirroring loadKeyForKID's precedence, but a
mirror is a second copy: loadKeyForKID now switches on classifyKeyArg and
delegates to loadSymmetricKeyFile/loadKeyFile/loadInlineKey, so the reading the
CLI reports is by construction the reading that happens. One behavior change
falls out: an existing but unreadable file now reports the read error instead
of falling through to a base64 attempt on its own path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 AGENTS.md  |  10 ++---
 claims.go  |   9 +++-
 jsonout.go |  12 +++---
 keys.go    | 120 ++++++++++++++++++++++++++++++++---------------------
 main.go    |  85 ++++++++++++++++++++++++++-----------
 5 files changed, 152 insertions(+), 84 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index c3c511d..3629949 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,9 +16,9 @@ All functionality lives in package `main`, split across six source files:
 - `headerKID()` - Extracts the token's `kid` header (or `""`) so JWK Set verification/decryption selects the key the token names
 - `printKeyInterpretation()` - Notes on stderr how a key argument was read when it was not read as a file, so precedence-based detection cannot silently take a value the user meant one way and use it another; adds the process-list exposure warning for `--key` values, which `JWTD_KEY` does not carry (`/proc/<pid>/cmdline` is world-readable, `/proc/<pid>/environ` is owner-only). Diagnostics go to stderr so stdout stays parseable
 - `readInteractive()` - Prompts for a token interactively using `chzyer/readline`
-- `decodeAndPrint()` - Parses the JWT with `golang-jwt/jwt` (`ParseUnverified`) and orchestrates output; verifies the signature when a key is provided
-- `parseUnverifiedJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data
-- `verifyJWTSignature()` / `verifySignature()` - `verifyJWTSignature` does the cryptographic check without printing, with `jwt.WithoutClaimsValidation()` so the result reflects only the signature, not expiry; it returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unparseable token/unusable key). `verifySignature` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero; the `--json` path reuses the same core
+- `decodeAndPrint()` / `printParsedJWT()` - `decodeAndPrint` parses the JWT with `golang-jwt/jwt` (`ParseUnverified`) and hands the result to `printParsedJWT`, which orchestrates output and verifies the signature when a key is provided. `printParsedJWT` runs `formatTimestamps` on a `maps.Clone` of the claims, so the display rewrite never touches the authoritative parse and the same `parsedJWT` can still be validated
+- `parsedJWT` / `parseUnverifiedJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data. `parseUnverifiedJWT` returns a `parsedJWT` (the raw string, token, segments, and claims) that is threaded through the decode, signature, and claim steps, so one run parses the token once instead of once per step
+- `verifyJWTSignature()` / `printSignatureVerdict()` / `verifySignature()` - `verifyJWTSignature` takes a `parsedJWT` and does the cryptographic check without printing, with `jwt.WithoutClaimsValidation()` so the result reflects only the signature, not expiry; it returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unusable key). `printSignatureVerdict` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero; `verifySignature` is the wrapper that parses first, for callers holding only the compact string. The `--json` path reuses the same core
 - `publicKeyForVerification()` - Extracts the public key from RSA/ECDSA/Ed25519 private keys
 
 ### `jsonout.go` - Machine-readable `--json` output
@@ -30,7 +30,7 @@ All functionality lives in package `main`, split across six source files:
 
 - `claimChecks` / `requested()` - Holds the `--verify-claims`, `--aud`, and `--iss` flag values. The zero value requests nothing, so the default stays decode-only and the exit code keeps reflecting the signature alone; `requested()` treats an expected audience or issuer as implying validation, so those flags work without also passing `--verify-claims`
 - `validateClaimsSet()` - Runs the requested RFC 7519 checks against the already-parsed claims via `jwt.NewValidator` with `jwt.WithTimeFunc(timeNow)` (so the verdict shares the display clock and is deterministic under `pinTime`), returning `valid` plus a reason. Temporal claims (`exp`, `nbf`) that are present are always checked; an expected `aud`/`iss` is additionally required to be present and match. A missing `exp` is not treated as expired. No signature verification happens here — the human and `--json` paths share this core
-- `verifyClaims()` / `claimReason()` - `verifyClaims` parses the token, calls the core, and renders `Claims: VALID`/`INVALID` with the reason, returning the `errInvalidClaims` sentinel on failure (and a hard error on an unparseable token). `claimReason` flattens the validator's newline-joined multi-error onto one `; `-separated line so the dim reason and wrapped error stay readable
+- `verifyClaims()` / `printClaimsVerdict()` / `claimReason()` - `printClaimsVerdict` runs the core against already-parsed claims and renders `Claims: VALID`/`INVALID` with the reason, returning the `errInvalidClaims` sentinel on failure; it must be given the raw parse, not the display copy `formatTimestamps` rewrites. `verifyClaims` is the wrapper that parses the token first (and returns a hard error on an unparseable one). `claimReason` flattens the validator's newline-joined multi-error onto one `; `-separated line so the dim reason and wrapped error stay readable
 
 **Claim validation is display-and-exit-code only, and deliberately separate from signature verification.** It performs no cryptography and runs whether or not a key is given, so `--verify-claims` on an unverified token still reports expiry — the two verdicts (`Signature:` and `Claims:`) are shown independently and either failing exits nonzero. This keeps the pre-existing invariant that a bare decode never fails on expiry intact: nothing validates claims unless a claim flag is passed.
 
@@ -44,7 +44,7 @@ All functionality lives in package `main`, split across six source files:
 
 - `loadKey()` / `loadKeyForKID()` / `parseKeyData()` / `parseAnyDER()` / `parseDERKey()` / `parseJWK()` - Resolve `raw:<secret>` and `hmac:<file>`, then an existing file path, then base64/base64url; parse loaded data as JWK/JWK Set, PEM, or DER (PKCS#1/PKCS#8/SEC 1/PKIX) keys and X.509 certificates, and error on anything else. `parseAnyDER` holds the one list of understood DER encodings, used both for raw DER and as `parseDERKey`'s fallback for an unrecognized PEM block type, so a format cannot be added to one and missed by the other. `parseKeyData` only detects formats: it never phrases a rejection, because `unsupportedKeyError` is the single place that knows the user-facing subject and the symmetric-form hint. Trailing newlines are trimmed only for ASCII `hmac:` files limited to printable bytes plus tab/CR/LF, while UTF-8/non-ASCII and other binary files remain byte-exact. `loadKeyForKID` threads the token's `kid` so a JWK Set selects the matching entry (`loadKey` is the `kid=""` wrapper); a `kid` that matches nothing returns the `errKIDNotFound` sentinel, which short-circuits the base64/unsupported-format fallbacks so a JWK Set miss fails closed with a clear message instead of degrading into other key material
 - `unsupportedKeyError()` - Explains a rejection and names the explicit symmetric form to use, substituting the user's own path so the fix is copy-pasteable; SSH keys get a conversion hint instead
-- `classifyKeyArg()` - Reports which reading `loadKey` will apply (`raw:` literal, `hmac:` secret file, existing file, base64, or unusable), mirroring its precedence so the CLI hint cannot drift from actual behavior; uses `Stat` rather than a read, so classifying never consumes the key source
+- `classifyKeyArg()` / `loadSymmetricKeyFile()` / `loadKeyFile()` / `loadInlineKey()` - `classifyKeyArg` decides which reading applies (`raw:` literal, `hmac:` secret file, existing file, base64, or unusable) and `loadKeyForKID` switches on it to call the matching loader, so the precedence exists once: the reading the CLI hint reports is by construction the reading that happens, not a mirror of it. It uses `Stat` rather than a read, so classifying never consumes the key source; a consequence is that an existing but unreadable file now reports the read error instead of falling through to a base64 attempt on its path
 - `decodeBase64Key()` / `symmetricKey()` - Decode whitespace-tolerant base64/base64url key material (applied to text key files as well as inline arguments, so the same bytes mean the same key either way) and gate symmetric secrets, rejecting empty key material
 - `isTextKey()` / `isSSHPublicKey()` / `isSSHKeyType()` / `sshBlobHasType()` - Distinguish ASCII text from binary for newline trimming, and detect SSH public keys for the targeted error
 
diff --git a/claims.go b/claims.go
index fc5526a..744abec 100644
--- a/claims.go
+++ b/claims.go
@@ -58,11 +58,18 @@ func validateClaimsSet(claims jwt.MapClaims, c claimChecks) (bool, error) {
 // a hard error instead. Claim validation is independent of the signature: it
 // runs with or without a key.
 func verifyClaims(w io.Writer, tokenStr string, c claimChecks) error {
-	_, _, claims, err := parseUnverifiedJWT(tokenStr)
+	p, err := parseUnverifiedJWT(tokenStr)
 	if err != nil {
 		return err
 	}
+	return printClaimsVerdict(w, p.claims, c)
+}
 
+// printClaimsVerdict runs the requested checks against already-parsed claims
+// and renders the verdict, so a caller that has parsed the token (the human
+// decode path) does not parse it again just to validate it. The claims must be
+// the raw parse, not the display copy formatTimestamps rewrites.
+func printClaimsVerdict(w io.Writer, claims jwt.MapClaims, c claimChecks) error {
 	valid, reason := validateClaimsSet(claims, c)
 	if !valid {
 		text := claimReason(reason)
diff --git a/jsonout.go b/jsonout.go
index 3a13ad2..7a55a69 100644
--- a/jsonout.go
+++ b/jsonout.go
@@ -44,20 +44,20 @@ type jweEncrypted struct {
 // so the exit code matches the human path; the signature verdict takes
 // precedence when both fail, though either way the exit is nonzero.
 func decodeJWTJSON(w io.Writer, tokenStr, keyStr string, checks claimChecks) error {
-	token, parts, claims, err := parseUnverifiedJWT(tokenStr)
+	p, err := parseUnverifiedJWT(tokenStr)
 	if err != nil {
 		return err
 	}
 
 	out := jwtJSON{
-		Header:    token.Header,
-		Payload:   map[string]any(claims),
-		Signature: parts[2],
+		Header:    p.token.Header,
+		Payload:   map[string]any(p.claims),
+		Signature: p.parts[2],
 	}
 
 	var invalid error
 	if keyStr != "" {
-		valid, reason, verr := verifyJWTSignature(tokenStr, keyStr)
+		valid, reason, verr := verifyJWTSignature(p, keyStr)
 		if verr != nil {
 			return fmt.Errorf("signature verification: %w", verr)
 		}
@@ -68,7 +68,7 @@ func decodeJWTJSON(w io.Writer, tokenStr, keyStr string, checks claimChecks) err
 	}
 
 	if checks.requested() {
-		valid, reason := validateClaimsSet(claims, checks)
+		valid, reason := validateClaimsSet(p.claims, checks)
 		out.ClaimsValid = &valid
 		if !valid && invalid == nil {
 			invalid = fmt.Errorf("%w: %s", errInvalidClaims, claimReason(reason))
diff --git a/keys.go b/keys.go
index 9d18db3..c9a9350 100644
--- a/keys.go
+++ b/keys.go
@@ -41,54 +41,77 @@ func loadKey(keyStr string) (any, error) {
 // token carries none); it only affects JWK Set selection and is ignored for
 // every other key form.
 func loadKeyForKID(keyStr, kid string) (any, error) {
-	// Explicit literal secret; no file or base64 detection.
-	if secret, ok := strings.CutPrefix(keyStr, "raw:"); ok {
-		return symmetricKey([]byte(secret))
+	// The precedence lives in classifyKeyArg and is applied here, so the
+	// reading the CLI reports is by construction the reading that happens.
+	switch classifyKeyArg(keyStr) {
+	case keySourceLiteral:
+		return symmetricKey([]byte(strings.TrimPrefix(keyStr, "raw:")))
+	case keySourceSecretFile:
+		return loadSymmetricKeyFile(strings.TrimPrefix(keyStr, "hmac:"))
+	case keySourceFile:
+		return loadKeyFile(keyStr, kid)
+	case keySourceBase64:
+		return loadInlineKey(keyStr, kid)
+	default:
+		return nil, fmt.Errorf("key is neither a valid file path nor base64-encoded data")
 	}
+}
 
-	// Explicit symmetric key file. Keeps secret bytes out of argv, where
-	// other local users can read them, and covers binary secrets that cannot
-	// be passed as text.
-	if path, ok := strings.CutPrefix(keyStr, "hmac:"); ok {
-		data, err := os.ReadFile(path)
-		if err != nil {
-			return nil, fmt.Errorf("reading symmetric key file %q: %w", path, err)
-		}
-		// Text secrets get the trailing newline editors typically add
-		// trimmed; binary key material is used byte-exact.
-		if isTextKey(data) {
-			data = bytes.TrimRight(data, "\r\n")
-		}
-		return symmetricKey(data)
+// loadSymmetricKeyFile reads an explicit hmac: secret file. Keeping the secret
+// bytes in a file rather than argv keeps them out of the process list, and
+// covers binary secrets that cannot be passed as text.
+func loadSymmetricKeyFile(path string) (any, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading symmetric key file %q: %w", path, err)
 	}
+	// Text secrets get the trailing newline editors typically add trimmed;
+	// binary key material is used byte-exact.
+	if isTextKey(data) {
+		data = bytes.TrimRight(data, "\r\n")
+	}
+	return symmetricKey(data)
+}
 
-	// Try as file path first.
-	if data, err := os.ReadFile(keyStr); err == nil {
-		if len(data) == 0 {
-			return nil, fmt.Errorf("key file %q is empty", keyStr)
-		}
-		if key, err := parseKeyData(data, kid); err == nil {
-			return key, nil
-		} else if errors.Is(err, errKIDNotFound) {
-			// The file is a valid JWK Set; a kid miss is final, not a reason
-			// to try base64 or fall through to the unsupported-format error.
-			return nil, err
-		}
-		// A text file may hold base64-encoded key material just as an inline
-		// key argument can, so the same bytes mean the same key either way.
-		if isTextKey(data) {
-			if decoded, ok := decodeBase64Key(bytes.TrimRight(data, "\r\n")); ok {
-				if key, err := parseKeyData(decoded, kid); err == nil {
-					return key, nil
-				} else if errors.Is(err, errKIDNotFound) {
-					return nil, err
-				}
+// loadKeyFile parses structured key material from a file, falling back to
+// base64-decoding its contents so a text file holding encoded key material
+// means the same key as that material passed inline.
+func loadKeyFile(path, kid string) (any, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading key file %q: %w", path, err)
+	}
+	if len(data) == 0 {
+		return nil, fmt.Errorf("key file %q is empty", path)
+	}
+
+	key, err := parseKeyData(data, kid)
+	if err == nil {
+		return key, nil
+	}
+	// The file is a valid JWK Set; a kid miss is final, not a reason to try
+	// base64 or fall through to the unsupported-format error.
+	if errors.Is(err, errKIDNotFound) {
+		return nil, err
+	}
+
+	if isTextKey(data) {
+		if decoded, ok := decodeBase64Key(bytes.TrimRight(data, "\r\n")); ok {
+			key, err := parseKeyData(decoded, kid)
+			if err == nil {
+				return key, nil
+			}
+			if errors.Is(err, errKIDNotFound) {
+				return nil, err
 			}
 		}
-		return nil, unsupportedKeyError(data, fmt.Sprintf("key file %q", keyStr), "hmac:"+keyStr)
 	}
+	return nil, unsupportedKeyError(data, fmt.Sprintf("key file %q", path), "hmac:"+path)
+}
 
-	// Try as base64-encoded key.
+// loadInlineKey parses base64/base64url key material given directly on the
+// command line or in JWTD_KEY.
+func loadInlineKey(keyStr, kid string) (any, error) {
 	decoded, ok := decodeBase64Key([]byte(keyStr))
 	if !ok {
 		return nil, fmt.Errorf("key is neither a valid file path nor base64-encoded data")
@@ -125,9 +148,10 @@ func symmetricKey(data []byte) (any, error) {
 	return data, nil
 }
 
-// keySource describes how loadKey will read a key argument. The CLI reports
-// it when the reading is not the obvious one, so a key that is silently taken
-// as something other than what the user meant becomes visible.
+// keySource describes how a key argument is read. It drives loadKeyForKID's
+// dispatch, and the CLI reports it when the reading is not the obvious one, so
+// a key silently taken as something other than what the user meant becomes
+// visible.
 type keySource int
 
 const (
@@ -143,10 +167,12 @@ const (
 	keySourceUnusable
 )
 
-// classifyKeyArg reports how loadKey will interpret keyStr, mirroring its
-// precedence: the explicit prefixes, then an existing file, then base64.
-// Existence is checked with Stat rather than a read, so classifying never
-// consumes the key source.
+// classifyKeyArg decides how a key argument is read: the explicit prefixes
+// first, then an existing file, then base64. loadKeyForKID dispatches on this
+// and the CLI narrates it, so the reported reading is the reading that happens
+// rather than a second copy of the ladder that could drift from it. Existence
+// is checked with Stat rather than a read, so classifying never consumes the
+// key source.
 func classifyKeyArg(keyStr string) keySource {
 	if strings.HasPrefix(keyStr, "raw:") {
 		return keySourceLiteral
diff --git a/main.go b/main.go
index 02722ee..bda0aa8 100644
--- a/main.go
+++ b/main.go
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"os"
 	"strings"
 
@@ -110,7 +111,12 @@ func run(cmd *cobra.Command, args []string) error {
 // either fails, with the signature verdict taking precedence for the returned
 // sentinel (both are suppressed by the top-level error printer).
 func decodeJWTHuman(w io.Writer, tokenStr, keyStr string, checks claimChecks) error {
-	derr := decodeAndPrint(w, tokenStr, keyStr)
+	p, err := parseUnverifiedJWT(tokenStr)
+	if err != nil {
+		return err
+	}
+
+	derr := printParsedJWT(w, p, keyStr)
 	if derr != nil && !errors.Is(derr, errInvalidSignature) {
 		return derr
 	}
@@ -120,7 +126,7 @@ func decodeJWTHuman(w io.Writer, tokenStr, keyStr string, checks claimChecks) er
 		if _, err := fmt.Fprintln(w); err != nil {
 			return err
 		}
-		cerr = verifyClaims(w, tokenStr, checks)
+		cerr = printClaimsVerdict(w, p.claims, checks)
 		if cerr != nil && !errors.Is(cerr, errInvalidClaims) {
 			return cerr
 		}
@@ -240,27 +246,36 @@ func readInteractive() (token string, err error) {
 // decodeAndPrint parses the JWT and prints header, payload, and signature.
 // If keyStr is provided, the signature is verified against the given key.
 func decodeAndPrint(w io.Writer, tokenStr, keyStr string) error {
-	token, parts, claims, err := parseUnverifiedJWT(tokenStr)
+	p, err := parseUnverifiedJWT(tokenStr)
 	if err != nil {
 		return err
 	}
+	return printParsedJWT(w, p, keyStr)
+}
 
+// printParsedJWT renders an already-parsed token, so callers that also need the
+// claims (claim validation) or the header (signature verification) parse once
+// and share the result instead of decoding the same segments again.
+func printParsedJWT(w io.Writer, p *parsedJWT, keyStr string) error {
 	f := newFormatter()
 
-	if err := printSection(w, f, "Header", token.Header); err != nil {
+	if err := printSection(w, f, "Header", p.token.Header); err != nil {
 		return err
 	}
 	if _, err := fmt.Fprintln(w); err != nil {
 		return err
 	}
-	formatTimestamps(claims)
-	if err := printSection(w, f, "Payload", claims); err != nil {
+	// formatTimestamps rewrites claim values into display strings, so it runs
+	// on a copy: p.claims stays the authoritative parse for validation.
+	display := maps.Clone(p.claims)
+	formatTimestamps(display)
+	if err := printSection(w, f, "Payload", display); err != nil {
 		return err
 	}
 	if _, err := fmt.Fprintln(w); err != nil {
 		return err
 	}
-	if err := printSignature(w, parts[2]); err != nil {
+	if err := printSignature(w, p.parts[2]); err != nil {
 		return err
 	}
 
@@ -268,7 +283,7 @@ func decodeAndPrint(w io.Writer, tokenStr, keyStr string) error {
 		if _, err := fmt.Fprintln(w); err != nil {
 			return err
 		}
-		if err := verifySignature(w, tokenStr, keyStr); err != nil {
+		if err := printSignatureVerdict(w, p, keyStr); err != nil {
 			return err
 		}
 	}
@@ -276,16 +291,27 @@ func decodeAndPrint(w io.Writer, tokenStr, keyStr string) error {
 	return nil
 }
 
-func parseUnverifiedJWT(tokenStr string) (*jwt.Token, []string, jwt.MapClaims, error) {
+// parsedJWT is one strict decode of a compact JWT: the token with its
+// display-decoded header, its three segments, and its claims. It is threaded
+// through the decode, signature, and claim steps so a single run parses the
+// token once rather than once per step.
+type parsedJWT struct {
+	raw    string
+	token  *jwt.Token
+	parts  []string
+	claims jwt.MapClaims
+}
+
+func parseUnverifiedJWT(tokenStr string) (*parsedJWT, error) {
 	parser := jwt.NewParser(jwt.WithJSONNumber())
 	token, parts, err := parser.ParseUnverified(tokenStr, jwt.MapClaims{})
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT: %w", err)
+		return nil, fmt.Errorf("parsing JWT: %w", err)
 	}
 
 	headerData, err := parser.DecodeSegment(parts[0])
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT header: decoding header: %w", err)
+		return nil, fmt.Errorf("parsing JWT header: decoding header: %w", err)
 	}
 
 	// Re-decode the header for display with the same strictness as the
@@ -293,25 +319,39 @@ func parseUnverifiedJWT(tokenStr string) (*jwt.Token, []string, jwt.MapClaims, e
 	// decodes it with plain json.Unmarshal, which loses number precision.
 	header := map[string]any{}
 	if err := decodeJSON(headerData, &header); err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT header: %w", err)
+		return nil, fmt.Errorf("parsing JWT header: %w", err)
 	}
 	token.Header = header
 
 	payload, err := parser.DecodeSegment(parts[1])
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT claims: decoding payload: %w", err)
+		return nil, fmt.Errorf("parsing JWT claims: decoding payload: %w", err)
 	}
 
 	claims := jwt.MapClaims{}
 	if err := decodeJSON(payload, &claims); err != nil {
-		return nil, nil, nil, fmt.Errorf("parsing JWT claims: %w", err)
+		return nil, fmt.Errorf("parsing JWT claims: %w", err)
 	}
-	return token, parts, claims, nil
+	return &parsedJWT{raw: tokenStr, token: token, parts: parts, claims: claims}, nil
 }
 
-// verifySignature verifies a JWT signature using the provided key and prints the result.
+// verifySignature verifies a JWT signature using the provided key and prints
+// the result. It parses the token itself, for callers that hold only the
+// compact string; printSignatureVerdict is the variant for a token already
+// parsed.
 func verifySignature(w io.Writer, tokenStr, keyStr string) error {
-	valid, reason, err := verifyJWTSignature(tokenStr, keyStr)
+	p, err := parseUnverifiedJWT(tokenStr)
+	if err != nil {
+		return fmt.Errorf("signature verification: %w", err)
+	}
+	return printSignatureVerdict(w, p, keyStr)
+}
+
+// printSignatureVerdict renders the signature verdict for an already-parsed
+// token and returns the errInvalidSignature sentinel on failure so the CLI
+// exits nonzero.
+func printSignatureVerdict(w io.Writer, p *parsedJWT, keyStr string) error {
+	valid, reason, err := verifyJWTSignature(p, keyStr)
 	if err != nil {
 		return fmt.Errorf("signature verification: %w", err)
 	}
@@ -331,13 +371,8 @@ func verifySignature(w io.Writer, tokenStr, keyStr string) error {
 // non-nil reason for a genuinely invalid signature; and a non-nil err only for
 // hard failures (unparseable token, unusable key) that are not a verdict on the
 // signature itself.
-func verifyJWTSignature(tokenStr, keyStr string) (valid bool, reason error, err error) {
-	token, _, _, err := parseUnverifiedJWT(tokenStr)
-	if err != nil {
-		return false, nil, err
-	}
-
-	key, err := loadKeyForKID(keyStr, headerKID(token.Header))
+func verifyJWTSignature(p *parsedJWT, keyStr string) (valid bool, reason error, err error) {
+	key, err := loadKeyForKID(keyStr, headerKID(p.token.Header))
 	if err != nil {
 		return false, nil, fmt.Errorf("error loading key: %w", err)
 	}
@@ -354,7 +389,7 @@ func verifyJWTSignature(tokenStr, keyStr string) (valid bool, reason error, err
 		opts = append(opts, jwt.WithValidMethods(methods))
 	}
 	parser := jwt.NewParser(opts...)
-	if _, perr := parser.Parse(tokenStr, func(*jwt.Token) (any, error) {
+	if _, perr := parser.Parse(p.raw, func(*jwt.Token) (any, error) {
 		return key, nil
 	}); perr != nil {
 		return false, perr, nil

From fe5e4b0226756935c2f281c0f67a06548add0cee Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 21:16:01 +0200
Subject: [PATCH 3/6] test: share one RSA key and one set of file-writing
 helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every generateRSAKey call generated a fresh 2048-bit key, ~60 of them per
run, which dominated the suite's wall time. The key is only ever read, so it
is now generated once with sync.OnceValues and shared; the ten call sites
that need a second key that must differ from the first ask for it explicitly
via generateDistinctRSAKey. Suite time drops from ~4.2s to ~1.9s.

The five key-file writers each open-coded marshal, PEM-encode, create, encode,
and twelve more sites open-coded filepath.Join(t.TempDir(), …) + os.WriteFile
with their own failure message. They now go through writeTempFile and
writePEMFile, with writePublicKeyFile covering RSA, ECDSA, and Ed25519 alike
(MarshalPKIXPublicKey handles all three) and writeJWKFile/writeJWKSetFile
covering the marshal-then-write JWK sites.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 helpers_test.go | 148 ++++++++++++++++++++++++++----------------------
 jwe_test.go     |   8 +--
 keys_test.go    | 101 ++++++---------------------------
 main_test.go    |  19 ++-----
 4 files changed, 107 insertions(+), 169 deletions(-)

diff --git a/helpers_test.go b/helpers_test.go
index 2b2547c..bae28c6 100644
--- a/helpers_test.go
+++ b/helpers_test.go
@@ -18,6 +18,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -77,8 +78,28 @@ func assertEscapedControlRunes(t *testing.T, output []byte, controls ...rune) {
 
 // --- JWE helpers -------------------------------------------------------------
 
-// generateRSAKey creates a fresh RSA key pair for testing.
+// sharedRSAKey generates the suite's default RSA key once. RSA generation
+// dominates the suite's runtime and the key is only ever read, so tests that
+// need "an RSA key" share this one.
+var sharedRSAKey = sync.OnceValues(func() (*rsa.PrivateKey, error) {
+	return rsa.GenerateKey(rand.Reader, 2048)
+})
+
+// generateRSAKey returns the shared RSA key pair. Use generateDistinctRSAKey
+// when a test needs a second key that must differ from this one, such as the
+// wrong-key cases.
 func generateRSAKey(t *testing.T) *rsa.PrivateKey {
+	t.Helper()
+	key, err := sharedRSAKey()
+	if err != nil {
+		t.Fatalf("generating RSA key: %v", err)
+	}
+	return key
+}
+
+// generateDistinctRSAKey creates a fresh RSA key pair that differs from the
+// shared one, for tests that need two keys at once.
+func generateDistinctRSAKey(t *testing.T) *rsa.PrivateKey {
 	t.Helper()
 	key, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
@@ -109,21 +130,61 @@ func encryptJWE(t *testing.T, key *rsa.PrivateKey, plaintext []byte) string {
 	return compact
 }
 
-// writeKeyFile writes an RSA private key to a temp PEM file and returns the path.
-func writeKeyFile(t *testing.T, key *rsa.PrivateKey) string {
+// writeTempFile writes data to a file of the given name in a fresh temp
+// directory and returns its path. Every helper that produces a key, key
+// material, or certificate file goes through it, so temp-file handling and its
+// failure message exist once.
+func writeTempFile(t *testing.T, name string, data []byte) string {
 	t.Helper()
-	der := x509.MarshalPKCS1PrivateKey(key)
-	block := &pem.Block{Type: "RSA PRIVATE KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-key.pem")
-	f, err := os.Create(path)
+	path := filepath.Join(t.TempDir(), name)
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		t.Fatalf("writing %s: %v", name, err)
+	}
+	return path
+}
+
+// writePEMFile PEM-encodes der under the given block type and writes it out.
+func writePEMFile(t *testing.T, name, blockType string, der []byte) string {
+	t.Helper()
+	return writeTempFile(t, name, pem.EncodeToMemory(&pem.Block{Type: blockType, Bytes: der}))
+}
+
+// writePublicKeyFile writes any public key as a PKIX "PUBLIC KEY" PEM file.
+// MarshalPKIXPublicKey handles RSA, ECDSA, and Ed25519 alike, so the key types
+// do not each need their own writer.
+func writePublicKeyFile(t *testing.T, name string, pub any) string {
+	t.Helper()
+	der, err := x509.MarshalPKIXPublicKey(pub)
+	if err != nil {
+		t.Fatalf("marshaling public key: %v", err)
+	}
+	return writePEMFile(t, name, "PUBLIC KEY", der)
+}
+
+// writeJWKFile marshals a single JWK and writes it to a temp file.
+func writeJWKFile(t *testing.T, name string, key any, kid string) string {
+	t.Helper()
+	data, err := json.Marshal(jose.JSONWebKey{Key: key, KeyID: kid})
 	if err != nil {
-		t.Fatalf("creating key file: %v", err)
+		t.Fatalf("marshaling JWK: %v", err)
 	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
+	return writeTempFile(t, name, data)
+}
+
+// writeJWKSetFile marshals a JWK Set and writes it to a temp file.
+func writeJWKSetFile(t *testing.T, name string, keys ...jose.JSONWebKey) string {
+	t.Helper()
+	data, err := json.Marshal(jose.JSONWebKeySet{Keys: keys})
+	if err != nil {
+		t.Fatalf("marshaling JWK Set: %v", err)
 	}
-	return path
+	return writeTempFile(t, name, data)
+}
+
+// writeKeyFile writes an RSA private key to a temp PEM file and returns the path.
+func writeKeyFile(t *testing.T, key *rsa.PrivateKey) string {
+	t.Helper()
+	return writePEMFile(t, "test-key.pem", "RSA PRIVATE KEY", x509.MarshalPKCS1PrivateKey(key))
 }
 
 // generateECKey creates a fresh ECDSA P-256 key pair for testing.
@@ -143,17 +204,7 @@ func writeECKeyFile(t *testing.T, key *ecdsa.PrivateKey) string {
 	if err != nil {
 		t.Fatalf("marshaling EC key: %v", err)
 	}
-	block := &pem.Block{Type: "EC PRIVATE KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-ec-key.pem")
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatalf("creating key file: %v", err)
-	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePEMFile(t, "test-ec-key.pem", "EC PRIVATE KEY", der)
 }
 
 // symmetricKeyArg writes symmetric key bytes to a temp file and returns the
@@ -167,11 +218,7 @@ func symmetricKeyArg(t *testing.T, key []byte) string {
 // writeSymmetricKeyFile writes raw symmetric key bytes to a temp file and returns the path.
 func writeSymmetricKeyFile(t *testing.T, key []byte) string {
 	t.Helper()
-	path := filepath.Join(t.TempDir(), "test-sym-key.bin")
-	if err := os.WriteFile(path, key, 0600); err != nil {
-		t.Fatalf("writing symmetric key file: %v", err)
-	}
-	return path
+	return writeTempFile(t, "test-sym-key.bin", key)
 }
 
 // encryptJWEGeneric creates a JWE compact serialization with the given algorithms and key.
@@ -226,41 +273,13 @@ func symmetricKeyForEnc(t *testing.T, enc jose.ContentEncryption) []byte {
 // writeRSAPublicKeyFile writes an RSA public key to a temp PEM file and returns the path.
 func writeRSAPublicKeyFile(t *testing.T, key *rsa.PublicKey) string {
 	t.Helper()
-	der, err := x509.MarshalPKIXPublicKey(key)
-	if err != nil {
-		t.Fatalf("marshaling RSA public key: %v", err)
-	}
-	block := &pem.Block{Type: "PUBLIC KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-rsa-pub.pem")
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatalf("creating key file: %v", err)
-	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePublicKeyFile(t, "test-rsa-pub.pem", key)
 }
 
 // writeECPublicKeyFile writes an ECDSA public key to a temp PEM file and returns the path.
 func writeECPublicKeyFile(t *testing.T, key *ecdsa.PublicKey) string {
 	t.Helper()
-	der, err := x509.MarshalPKIXPublicKey(key)
-	if err != nil {
-		t.Fatalf("marshaling EC public key: %v", err)
-	}
-	block := &pem.Block{Type: "PUBLIC KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-ec-pub.pem")
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatalf("creating key file: %v", err)
-	}
-	defer f.Close()
-	if err := pem.Encode(f, block); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePublicKeyFile(t, "test-ec-pub.pem", key)
 }
 
 func writeRSACertificateFiles(t *testing.T, key *rsa.PrivateKey) (pemPath, derPath string, pemBytes []byte) {
@@ -347,12 +366,7 @@ func writeEd25519KeyFile(t *testing.T, key ed25519.PrivateKey) string {
 	if err != nil {
 		t.Fatalf("marshaling Ed25519 key: %v", err)
 	}
-	block := &pem.Block{Type: "PRIVATE KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-ed25519-key.pem")
-	if err := os.WriteFile(path, pem.EncodeToMemory(block), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writePEMFile(t, "test-ed25519-key.pem", "PRIVATE KEY", der)
 }
 
 // signJWTWithEd25519 creates a signed JWT using Ed25519 with the given private key.
@@ -385,11 +399,7 @@ func sshEd25519PublicKeyLine(pub ed25519.PublicKey, comment string) string {
 
 func writeTextKeyFile(t *testing.T, name, contents string) string {
 	t.Helper()
-	path := filepath.Join(t.TempDir(), name)
-	if err := os.WriteFile(path, []byte(contents), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
-	return path
+	return writeTempFile(t, name, []byte(contents))
 }
 
 func signJWTWithEd25519(t *testing.T, key ed25519.PrivateKey, claims jwt.MapClaims) string {
diff --git a/jwe_test.go b/jwe_test.go
index f7d8ecc..7bd481d 100644
--- a/jwe_test.go
+++ b/jwe_test.go
@@ -192,7 +192,7 @@ func TestDecodeAndPrintJWE_InvalidToken(t *testing.T) {
 
 func TestDecodeAndPrintJWE_WrongKey(t *testing.T) {
 	key := generateRSAKey(t)
-	wrongKey := generateRSAKey(t)
+	wrongKey := generateDistinctRSAKey(t)
 	token := encryptJWE(t, key, []byte(`{"sub":"user1"}`))
 	keyPath := writeKeyFile(t, wrongKey)
 
@@ -591,7 +591,7 @@ func TestDecodeAndPrintJWE_RSAKeyAlgorithms(t *testing.T) {
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateRSAKey(t)
+			key := generateDistinctRSAKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"rsa-test","role":"user"}`))
 			keyPath := writeKeyFile(t, key)
 
@@ -968,7 +968,7 @@ func TestDecodeAndPrintJWE_ContentEncryptionAlgorithms(t *testing.T) {
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateRSAKey(t)
+			key := generateDistinctRSAKey(t)
 			token := encryptJWEGeneric(t, jose.RSA_OAEP, tt.enc, &key.PublicKey, []byte(`{"sub":"enc-test","enc_alg":"tested"}`))
 			keyPath := writeKeyFile(t, key)
 
@@ -1122,7 +1122,7 @@ func TestDecodeAndPrintJWE_NestedJWT(t *testing.T) {
 	innerJWT := signJWT(t, signingKey, claims)
 
 	// Encrypt the JWT inside a JWE.
-	encKey := generateRSAKey(t)
+	encKey := generateDistinctRSAKey(t)
 	jweToken := encryptJWE(t, encKey, []byte(innerJWT))
 
 	encKeyPath := writeKeyFile(t, encKey)
diff --git a/keys_test.go b/keys_test.go
index 4f664f0..669158d 100644
--- a/keys_test.go
+++ b/keys_test.go
@@ -11,7 +11,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"encoding/pem"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -100,10 +99,7 @@ func TestLoadKey_RawPrefix(t *testing.T) {
 }
 
 func TestLoadKey_TextKeyFileTrimsTrailingNewline(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "secret.txt")
-	if err := os.WriteFile(path, []byte("my-text-secret\n"), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
+	path := writeTempFile(t, "secret.txt", []byte("my-text-secret\n"))
 
 	loaded, err := loadKey("hmac:" + path)
 	if err != nil {
@@ -242,10 +238,7 @@ func TestLoadKey_PKCS1RSAPublicKeyFromPEMFile(t *testing.T) {
 	priv := generateRSAKey(t)
 	der := x509.MarshalPKCS1PublicKey(&priv.PublicKey)
 	block := &pem.Block{Type: "RSA PUBLIC KEY", Bytes: der}
-	path := filepath.Join(t.TempDir(), "test-rsa-pub-pkcs1.pem")
-	if err := os.WriteFile(path, pem.EncodeToMemory(block), 0600); err != nil {
-		t.Fatalf("writing key file: %v", err)
-	}
+	path := writeTempFile(t, "test-rsa-pub-pkcs1.pem", pem.EncodeToMemory(block))
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -360,10 +353,7 @@ func TestLoadKey_RejectsMalformedStructuredData(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Run("file", func(t *testing.T) {
-				path := filepath.Join(t.TempDir(), "structured-key")
-				if err := os.WriteFile(path, tt.data, 0600); err != nil {
-					t.Fatalf("writing structured key data: %v", err)
-				}
+				path := writeTempFile(t, "structured-key", tt.data)
 				if loaded, err := loadKey(path); err == nil {
 					t.Fatalf("expected parsing error, got %T", loaded)
 				} else if !strings.Contains(err.Error(), path) {
@@ -405,10 +395,7 @@ func TestLoadKey_OpaqueDataRequiresExplicitSymmetricForm(t *testing.T) {
 				t.Run(mode, func(t *testing.T) {
 					input := base64.StdEncoding.EncodeToString(tt.data)
 					if mode == "file" {
-						input = filepath.Join(t.TempDir(), "opaque-key")
-						if err := os.WriteFile(input, tt.data, 0600); err != nil {
-							t.Fatalf("writing opaque key: %v", err)
-						}
+						input = writeTempFile(t, "opaque-key", tt.data)
 					}
 
 					if loaded, err := loadKey(input); err == nil {
@@ -424,15 +411,7 @@ func TestLoadKey_OpaqueDataRequiresExplicitSymmetricForm(t *testing.T) {
 
 func TestLoadKey_RSAPrivateKeyFromJWKFile(t *testing.T) {
 	priv := generateRSAKey(t)
-	jwk := jose.JSONWebKey{Key: priv, KeyID: "test-rsa"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "rsa-priv.jwk")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "rsa-priv.jwk", priv, "test-rsa")
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -450,15 +429,7 @@ func TestLoadKey_RSAPrivateKeyFromJWKFile(t *testing.T) {
 
 func TestLoadKey_RSAPublicKeyFromJWKFile(t *testing.T) {
 	priv := generateRSAKey(t)
-	jwk := jose.JSONWebKey{Key: &priv.PublicKey, KeyID: "test-rsa-pub"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "rsa-pub.jwk")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "rsa-pub.jwk", &priv.PublicKey, "test-rsa-pub")
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -476,15 +447,7 @@ func TestLoadKey_RSAPublicKeyFromJWKFile(t *testing.T) {
 
 func TestLoadKey_ECPrivateKeyFromJWKFile(t *testing.T) {
 	priv := generateECKey(t)
-	jwk := jose.JSONWebKey{Key: priv, KeyID: "test-ec"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "ec-priv.jwk")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "ec-priv.jwk", priv, "test-ec")
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -502,21 +465,11 @@ func TestLoadKey_ECPrivateKeyFromJWKFile(t *testing.T) {
 
 func TestLoadKey_JWKSetFirstKey(t *testing.T) {
 	priv1 := generateRSAKey(t)
-	priv2 := generateRSAKey(t)
-	jwks := jose.JSONWebKeySet{
-		Keys: []jose.JSONWebKey{
-			{Key: &priv1.PublicKey, KeyID: "key-1"},
-			{Key: &priv2.PublicKey, KeyID: "key-2"},
-		},
-	}
-	data, err := json.Marshal(jwks)
-	if err != nil {
-		t.Fatalf("marshaling JWK Set: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "jwks.json")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK Set file: %v", err)
-	}
+	priv2 := generateDistinctRSAKey(t)
+	path := writeJWKSetFile(t, "jwks.json",
+		jose.JSONWebKey{Key: &priv1.PublicKey, KeyID: "key-1"},
+		jose.JSONWebKey{Key: &priv2.PublicKey, KeyID: "key-2"},
+	)
 
 	loaded, err := loadKey(path)
 	if err != nil {
@@ -539,21 +492,11 @@ func TestLoadKey_JWKSetFirstKey(t *testing.T) {
 func writeJWKSet(t *testing.T) (path string, priv1, priv2 *rsa.PrivateKey) {
 	t.Helper()
 	priv1 = generateRSAKey(t)
-	priv2 = generateRSAKey(t)
-	jwks := jose.JSONWebKeySet{
-		Keys: []jose.JSONWebKey{
-			{Key: &priv1.PublicKey, KeyID: "key-1"},
-			{Key: &priv2.PublicKey, KeyID: "key-2"},
-		},
-	}
-	data, err := json.Marshal(jwks)
-	if err != nil {
-		t.Fatalf("marshaling JWK Set: %v", err)
-	}
-	path = filepath.Join(t.TempDir(), "jwks.json")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK Set file: %v", err)
-	}
+	priv2 = generateDistinctRSAKey(t)
+	path = writeJWKSetFile(t, "jwks.json",
+		jose.JSONWebKey{Key: &priv1.PublicKey, KeyID: "key-1"},
+		jose.JSONWebKey{Key: &priv2.PublicKey, KeyID: "key-2"},
+	)
 	return path, priv1, priv2
 }
 
@@ -606,15 +549,7 @@ func TestLoadKeyForKID_UnknownKIDFailsClosed(t *testing.T) {
 // behavior is preserved and verification fails naturally on a genuine mismatch.
 func TestLoadKeyForKID_SingleJWKIgnoresKID(t *testing.T) {
 	priv := generateRSAKey(t)
-	jwk := jose.JSONWebKey{Key: &priv.PublicKey, KeyID: "the-only-key"}
-	data, err := json.Marshal(jwk)
-	if err != nil {
-		t.Fatalf("marshaling JWK: %v", err)
-	}
-	path := filepath.Join(t.TempDir(), "jwk.json")
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		t.Fatalf("writing JWK file: %v", err)
-	}
+	path := writeJWKFile(t, "jwk.json", &priv.PublicKey, "the-only-key")
 
 	loaded, err := loadKeyForKID(path, "some-other-kid")
 	if err != nil {
diff --git a/main_test.go b/main_test.go
index 5888942..eac68fa 100644
--- a/main_test.go
+++ b/main_test.go
@@ -11,7 +11,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -626,7 +625,7 @@ func TestDecodeAndPrint_SignatureValid_RSAPublicKey(t *testing.T) {
 
 func TestDecodeAndPrint_SignatureInvalid_WrongKey(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKey := generateRSAKey(t)
+	wrongKey := generateDistinctRSAKey(t)
 	wrongKeyPath := writeKeyFile(t, wrongKey)
 	claims := jwt.MapClaims{"sub": "test"}
 	token := signJWT(t, signingKey, claims)
@@ -645,7 +644,7 @@ func TestDecodeAndPrint_SignatureInvalid_WrongKey(t *testing.T) {
 
 func TestVerifySignature_InvalidOutputWriterErrors(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKeyPath := writeKeyFile(t, generateRSAKey(t))
+	wrongKeyPath := writeKeyFile(t, generateDistinctRSAKey(t))
 	token := signJWT(t, signingKey, jwt.MapClaims{"sub": "test"})
 
 	tests := []struct {
@@ -756,10 +755,7 @@ func TestDecodeAndPrint_UnparseableKeyNeverBecomesHMACSecret(t *testing.T) {
 				t.Run(mode, func(t *testing.T) {
 					keyInput := base64.StdEncoding.EncodeToString(tt.data)
 					if mode == "file" {
-						keyInput = filepath.Join(t.TempDir(), "malformed.jwk")
-						if err := os.WriteFile(keyInput, tt.data, 0600); err != nil {
-							t.Fatalf("writing key material: %v", err)
-						}
+						keyInput = writeTempFile(t, "malformed.jwk", tt.data)
 					}
 					token := signJWTWithHMAC(t, tt.data, jwt.MapClaims{"sub": "test"})
 
@@ -862,10 +858,7 @@ func TestDecodeAndPrint_SignatureValid_Ed25519PublicKey(t *testing.T) {
 		t.Fatalf("marshaling Ed25519 public key: %v", err)
 	}
 	block := &pem.Block{Type: "PUBLIC KEY", Bytes: der}
-	pubKeyPath := filepath.Join(t.TempDir(), "test-ed25519-pub.pem")
-	if err := os.WriteFile(pubKeyPath, pem.EncodeToMemory(block), 0600); err != nil {
-		t.Fatalf("writing public key file: %v", err)
-	}
+	pubKeyPath := writeTempFile(t, "test-ed25519-pub.pem", pem.EncodeToMemory(block))
 
 	var buf bytes.Buffer
 	err = decodeAndPrint(&buf, token, pubKeyPath)
@@ -968,7 +961,7 @@ func TestRun_JWTDKeyEnvVar_JWSVerification(t *testing.T) {
 
 func TestRun_KeyFlagOverridesEnvVar(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKey := generateRSAKey(t)
+	wrongKey := generateDistinctRSAKey(t)
 	signingKeyPath := writeKeyFile(t, signingKey)
 	wrongKeyPath := writeKeyFile(t, wrongKey)
 	claims := jwt.MapClaims{"sub": "override-test"}
@@ -1083,7 +1076,7 @@ func TestRun_KeyInterpretationHint(t *testing.T) {
 
 func TestRun_InvalidSignatureReturnsErrorWithoutUsage(t *testing.T) {
 	signingKey := generateRSAKey(t)
-	wrongKeyPath := writeKeyFile(t, generateRSAKey(t))
+	wrongKeyPath := writeKeyFile(t, generateDistinctRSAKey(t))
 	token := signJWT(t, signingKey, jwt.MapClaims{"sub": "test"})
 
 	rootCmd := newRootCommand()

From 0d96922df934e0e1391738e7957464e6f1134fbc Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 21:18:04 +0200
Subject: [PATCH 4/6] test: collapse the JWE algorithm-family tests onto shared
 assertions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Seven algorithm-coverage tests repeated the same two subtest bodies —
decode without a key and assert the header sections, decode with one and
assert the payload — differing only in how that family's key is made. They
now call assertJWEHeaderOnly/assertJWEDecrypts, and the AESKW and AESGCMKW
tests merge into one table since they differed only in key size and content
encryption. Key setup also moves out of the subtests, so each family builds
its key once instead of once per subtest.

Same 62 subtests over the same algorithms and payloads; the header-only
cases now additionally assert the Encrypted Content section, which the
per-family copies asserted inconsistently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 helpers_test.go |  49 +++++
 jwe_test.go     | 482 +++++++++---------------------------------------
 2 files changed, 135 insertions(+), 396 deletions(-)

diff --git a/helpers_test.go b/helpers_test.go
index bae28c6..1ba1b14 100644
--- a/helpers_test.go
+++ b/helpers_test.go
@@ -308,6 +308,55 @@ func writeRSACertificateFiles(t *testing.T, key *rsa.PrivateKey) (pemPath, derPa
 	return pemPath, derPath, pemBytes
 }
 
+// --- JWE algorithm-coverage assertions ---------------------------------------
+
+// assertOutputContains checks that every wanted substring appears in the
+// color-stripped output, reporting the whole output once on a miss.
+func assertOutputContains(t *testing.T, out string, wants ...string) {
+	t.Helper()
+	plain := stripANSI(out)
+	for _, want := range wants {
+		if !strings.Contains(plain, want) {
+			t.Errorf("output missing %q:\n%s", want, plain)
+		}
+	}
+}
+
+// assertJWEHeaderOnly decodes a JWE without a key and asserts the header-only
+// rendering: the protected header, the encrypted-part metadata, and the
+// algorithm names the header is expected to carry.
+func assertJWEHeaderOnly(t *testing.T, token string, wants ...string) {
+	t.Helper()
+	var buf bytes.Buffer
+	if err := decodeAndPrintJWE(&buf, token, ""); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	assertOutputContains(t, buf.String(), append([]string{"Protected Header", "Encrypted Content"}, wants...)...)
+}
+
+// assertJWEDecrypts decodes a JWE with the given key argument and asserts the
+// decrypted payload section carries the expected values.
+func assertJWEDecrypts(t *testing.T, token, keyArg string, wants ...string) {
+	t.Helper()
+	var buf bytes.Buffer
+	if err := decodeAndPrintJWE(&buf, token, keyArg); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	assertOutputContains(t, buf.String(), append([]string{"Decrypted Payload"}, wants...)...)
+}
+
+// randomSymmetricKey returns size random bytes for the AES key-wrapping
+// algorithms, whose key length is fixed by the algorithm rather than derived
+// from the content encryption (that is symmetricKeyForEnc's job).
+func randomSymmetricKey(t *testing.T, size int) []byte {
+	t.Helper()
+	key := make([]byte, size)
+	if _, err := rand.Read(key); err != nil {
+		t.Fatalf("generating symmetric key: %v", err)
+	}
+	return key
+}
+
 // --- JWS signature verification -----------------------------------------------
 
 // signJWT creates a signed JWT with the given claims and RSA private key.
diff --git a/jwe_test.go b/jwe_test.go
index 7bd481d..87991b1 100644
--- a/jwe_test.go
+++ b/jwe_test.go
@@ -552,65 +552,33 @@ func TestDecodeAndPrintJWE_EndToEnd_WithDecrypt(t *testing.T) {
 }
 
 // --- Algorithm coverage: key management algorithms ---------------------------
+//
+// Each family runs the same two checks per algorithm — decode without a key
+// (header and encrypted-part metadata) and decode with one (decrypted payload)
+// — so they share assertJWEHeaderOnly/assertJWEDecrypts and differ only in how
+// the key for that family is made.
 
 func TestDecodeAndPrintJWE_RSAKeyAlgorithms(t *testing.T) {
 	tests := []struct {
 		name   string
 		keyAlg jose.KeyAlgorithm
-		algStr string
 	}{
-		{"RSA-OAEP", jose.RSA_OAEP, "RSA-OAEP"},
-		{"RSA-OAEP-256", jose.RSA_OAEP_256, "RSA-OAEP-256"},
-		{"RSA1_5", jose.RSA1_5, "RSA1_5"},
+		{"RSA-OAEP", jose.RSA_OAEP},
+		{"RSA-OAEP-256", jose.RSA_OAEP_256},
+		{"RSA1_5", jose.RSA1_5},
 	}
 
 	for _, tt := range tests {
+		key := generateRSAKey(t)
+
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			key := generateRSAKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"rsa-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "A128GCM") {
-				t.Error("output missing content encryption A128GCM")
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			assertJWEHeaderOnly(t, token, tt.name, "A128GCM")
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateDistinctRSAKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"rsa-test","role":"user"}`))
-			keyPath := writeKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "rsa-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "user") {
-				t.Error("output missing decrypted role value")
-			}
+			assertJWEDecrypts(t, token, writeKeyFile(t, key), "rsa-test", "user")
 		})
 	}
 }
@@ -619,250 +587,80 @@ func TestDecodeAndPrintJWE_ECDHESKeyAlgorithms(t *testing.T) {
 	tests := []struct {
 		name   string
 		keyAlg jose.KeyAlgorithm
-		algStr string
 	}{
-		{"ECDH-ES", jose.ECDH_ES, "ECDH-ES"},
-		{"ECDH-ES+A128KW", jose.ECDH_ES_A128KW, "ECDH-ES+A128KW"},
-		{"ECDH-ES+A192KW", jose.ECDH_ES_A192KW, "ECDH-ES+A192KW"},
-		{"ECDH-ES+A256KW", jose.ECDH_ES_A256KW, "ECDH-ES+A256KW"},
+		{"ECDH-ES", jose.ECDH_ES},
+		{"ECDH-ES+A128KW", jose.ECDH_ES_A128KW},
+		{"ECDH-ES+A192KW", jose.ECDH_ES_A192KW},
+		{"ECDH-ES+A256KW", jose.ECDH_ES_A256KW},
 	}
 
 	for _, tt := range tests {
+		key := generateECKey(t)
+
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			key := generateECKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"ec-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			assertJWEHeaderOnly(t, token, tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateECKey(t)
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, &key.PublicKey, []byte(`{"sub":"ec-test","data":"secret"}`))
-			keyPath := writeECKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "ec-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "secret") {
-				t.Error("output missing decrypted data value")
-			}
+			assertJWEDecrypts(t, token, writeECKeyFile(t, key), "ec-test", "secret")
 		})
 	}
 }
 
-func TestDecodeAndPrintJWE_AESKWKeyAlgorithms(t *testing.T) {
+func TestDecodeAndPrintJWE_AESKeyWrappingAlgorithms(t *testing.T) {
 	tests := []struct {
 		name    string
 		keyAlg  jose.KeyAlgorithm
-		algStr  string
+		enc     jose.ContentEncryption
 		keySize int
 	}{
-		{"A128KW", jose.A128KW, "A128KW", 16},
-		{"A192KW", jose.A192KW, "A192KW", 24},
-		{"A256KW", jose.A256KW, "A256KW", 32},
+		{"A128KW", jose.A128KW, jose.A128GCM, 16},
+		{"A192KW", jose.A192KW, jose.A128GCM, 24},
+		{"A256KW", jose.A256KW, jose.A128GCM, 32},
+		{"A128GCMKW", jose.A128GCMKW, jose.A256GCM, 16},
+		{"A192GCMKW", jose.A192GCMKW, jose.A256GCM, 24},
+		{"A256GCMKW", jose.A256GCMKW, jose.A256GCM, 32},
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, symKey, []byte(`{"sub":"aeskw-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
-		})
-
-		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, symKey, []byte(`{"sub":"aeskw-test","msg":"hello"}`))
-			keyArg := symmetricKeyArg(t, symKey)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
+		symKey := randomSymmetricKey(t, tt.keySize)
 
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "aeskw-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "hello") {
-				t.Error("output missing decrypted msg value")
-			}
-		})
-	}
-}
-
-func TestDecodeAndPrintJWE_AESGCMKWKeyAlgorithms(t *testing.T) {
-	tests := []struct {
-		name    string
-		keyAlg  jose.KeyAlgorithm
-		algStr  string
-		keySize int
-	}{
-		{"A128GCMKW", jose.A128GCMKW, "A128GCMKW", 16},
-		{"A192GCMKW", jose.A192GCMKW, "A192GCMKW", 24},
-		{"A256GCMKW", jose.A256GCMKW, "A256GCMKW", 32},
-	}
-
-	for _, tt := range tests {
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A256GCM, symKey, []byte(`{"sub":"aesgcmkw-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			token := encryptJWEGeneric(t, tt.keyAlg, tt.enc, symKey, []byte(`{"sub":"aeskw-test"}`))
+			assertJWEHeaderOnly(t, token, tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			symKey := make([]byte, tt.keySize)
-			if _, err := rand.Read(symKey); err != nil {
-				t.Fatalf("generating key: %v", err)
-			}
-			token := encryptJWEGeneric(t, tt.keyAlg, jose.A256GCM, symKey, []byte(`{"sub":"aesgcmkw-test","status":"ok"}`))
-			keyArg := symmetricKeyArg(t, symKey)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "aesgcmkw-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "ok") {
-				t.Error("output missing decrypted status value")
-			}
+			token := encryptJWEGeneric(t, tt.keyAlg, tt.enc, symKey, []byte(`{"sub":"aeskw-test","msg":"hello"}`))
+			assertJWEDecrypts(t, token, symmetricKeyArg(t, symKey), "aeskw-test", "hello")
 		})
 	}
 }
 
 func TestDecodeAndPrintJWE_DirectKeyAgreement(t *testing.T) {
 	contentEncs := []struct {
-		name   string
-		enc    jose.ContentEncryption
-		encStr string
+		name string
+		enc  jose.ContentEncryption
 	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256, "A128CBC-HS256"},
-		{"A256CBC-HS512", jose.A256CBC_HS512, "A256CBC-HS512"},
-		{"A128GCM", jose.A128GCM, "A128GCM"},
-		{"A256GCM", jose.A256GCM, "A256GCM"},
+		{"A128CBC-HS256", jose.A128CBC_HS256},
+		{"A256CBC-HS512", jose.A256CBC_HS512},
+		{"A128GCM", jose.A128GCM},
+		{"A256GCM", jose.A256GCM},
 	}
 
 	for _, tt := range contentEncs {
+		symKey := symmetricKeyForEnc(t, tt.enc)
+
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			symKey := symmetricKeyForEnc(t, tt.enc)
 			token := encryptJWEGeneric(t, jose.DIRECT, tt.enc, symKey, []byte(`{"sub":"dir-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, "dir") {
-				t.Error("output missing algorithm 'dir'")
-			}
-			if !strings.Contains(plain, tt.encStr) {
-				t.Errorf("output missing content encryption %q", tt.encStr)
-			}
+			assertJWEHeaderOnly(t, token, "dir", tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			symKey := symmetricKeyForEnc(t, tt.enc)
 			token := encryptJWEGeneric(t, jose.DIRECT, tt.enc, symKey, []byte(`{"sub":"dir-test","val":"direct"}`))
-			keyArg := symmetricKeyArg(t, symKey)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "dir-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "direct") {
-				t.Error("output missing decrypted val value")
-			}
+			assertJWEDecrypts(t, token, symmetricKeyArg(t, symKey), "dir-test", "direct")
 		})
 	}
 }
@@ -871,59 +669,25 @@ func TestDecodeAndPrintJWE_PBES2KeyAlgorithms(t *testing.T) {
 	tests := []struct {
 		name   string
 		keyAlg jose.KeyAlgorithm
-		algStr string
 	}{
-		{"PBES2-HS256+A128KW", jose.PBES2_HS256_A128KW, "PBES2-HS256+A128KW"},
-		{"PBES2-HS384+A192KW", jose.PBES2_HS384_A192KW, "PBES2-HS384+A192KW"},
-		{"PBES2-HS512+A256KW", jose.PBES2_HS512_A256KW, "PBES2-HS512+A256KW"},
+		{"PBES2-HS256+A128KW", jose.PBES2_HS256_A128KW},
+		{"PBES2-HS384+A192KW", jose.PBES2_HS384_A192KW},
+		{"PBES2-HS512+A256KW", jose.PBES2_HS512_A256KW},
 	}
 
-	for _, tt := range tests {
-		password := []byte("test-password-for-jwtd")
+	password := []byte("test-password-for-jwtd")
 
+	for _, tt := range tests {
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, password, []byte(`{"sub":"pbes2-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.algStr) {
-				t.Errorf("output missing algorithm %q", tt.algStr)
-			}
-			if !strings.Contains(plain, "Encrypted Content") {
-				t.Error("output missing Encrypted Content section")
-			}
+			assertJWEHeaderOnly(t, token, tt.name)
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
 			token := encryptJWEGeneric(t, tt.keyAlg, jose.A128GCM, password, []byte(`{"sub":"pbes2-test","auth":"pass"}`))
 			// For PBES2 the "key" is a password, so it is passed as an
 			// explicit literal secret.
-			passwordArg := "raw:" + string(password)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, passwordArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "pbes2-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "pass") {
-				t.Error("output missing decrypted auth value")
-			}
+			assertJWEDecrypts(t, token, "raw:"+string(password), "pbes2-test", "pass")
 		})
 	}
 }
@@ -932,62 +696,28 @@ func TestDecodeAndPrintJWE_PBES2KeyAlgorithms(t *testing.T) {
 
 func TestDecodeAndPrintJWE_ContentEncryptionAlgorithms(t *testing.T) {
 	tests := []struct {
-		name   string
-		enc    jose.ContentEncryption
-		encStr string
+		name string
+		enc  jose.ContentEncryption
 	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256, "A128CBC-HS256"},
-		{"A192CBC-HS384", jose.A192CBC_HS384, "A192CBC-HS384"},
-		{"A256CBC-HS512", jose.A256CBC_HS512, "A256CBC-HS512"},
-		{"A128GCM", jose.A128GCM, "A128GCM"},
-		{"A192GCM", jose.A192GCM, "A192GCM"},
-		{"A256GCM", jose.A256GCM, "A256GCM"},
+		{"A128CBC-HS256", jose.A128CBC_HS256},
+		{"A192CBC-HS384", jose.A192CBC_HS384},
+		{"A256CBC-HS512", jose.A256CBC_HS512},
+		{"A128GCM", jose.A128GCM},
+		{"A192GCM", jose.A192GCM},
+		{"A256GCM", jose.A256GCM},
 	}
 
+	key := generateRSAKey(t)
+
 	for _, tt := range tests {
 		t.Run(tt.name+"/header_only", func(t *testing.T) {
-			key := generateRSAKey(t)
 			token := encryptJWEGeneric(t, jose.RSA_OAEP, tt.enc, &key.PublicKey, []byte(`{"sub":"enc-test"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, "")
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Protected Header") {
-				t.Error("output missing Protected Header")
-			}
-			if !strings.Contains(plain, tt.encStr) {
-				t.Errorf("output missing content encryption %q", tt.encStr)
-			}
-			if !strings.Contains(plain, "RSA-OAEP") {
-				t.Error("output missing algorithm RSA-OAEP")
-			}
+			assertJWEHeaderOnly(t, token, tt.name, "RSA-OAEP")
 		})
 
 		t.Run(tt.name+"/decrypt", func(t *testing.T) {
-			key := generateDistinctRSAKey(t)
 			token := encryptJWEGeneric(t, jose.RSA_OAEP, tt.enc, &key.PublicKey, []byte(`{"sub":"enc-test","enc_alg":"tested"}`))
-			keyPath := writeKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "enc-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "tested") {
-				t.Error("output missing decrypted enc_alg value")
-			}
+			assertJWEDecrypts(t, token, writeKeyFile(t, key), "enc-test", "tested")
 		})
 	}
 }
@@ -995,83 +725,43 @@ func TestDecodeAndPrintJWE_ContentEncryptionAlgorithms(t *testing.T) {
 // --- Cross-algorithm combinations --------------------------------------------
 
 func TestDecodeAndPrintJWE_ECDHES_WithAllContentEncryptions(t *testing.T) {
-	contentEncs := []struct {
-		name string
-		enc  jose.ContentEncryption
-	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256},
-		{"A256CBC-HS512", jose.A256CBC_HS512},
-		{"A128GCM", jose.A128GCM},
-		{"A256GCM", jose.A256GCM},
+	contentEncs := []jose.ContentEncryption{
+		jose.A128CBC_HS256,
+		jose.A256CBC_HS512,
+		jose.A128GCM,
+		jose.A256GCM,
 	}
 
-	for _, tt := range contentEncs {
-		t.Run("ECDH-ES+A256KW/"+tt.name, func(t *testing.T) {
-			key := generateECKey(t)
-			token := encryptJWEGeneric(t, jose.ECDH_ES_A256KW, tt.enc, &key.PublicKey,
-				[]byte(`{"sub":"cross-test","msg":"combo"}`))
-			keyPath := writeECKeyFile(t, key)
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyPath)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
+	key := generateECKey(t)
+	keyPath := writeECKeyFile(t, key)
 
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "cross-test") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "combo") {
-				t.Error("output missing decrypted msg value")
-			}
+	for _, enc := range contentEncs {
+		t.Run("ECDH-ES+A256KW/"+string(enc), func(t *testing.T) {
+			token := encryptJWEGeneric(t, jose.ECDH_ES_A256KW, enc, &key.PublicKey,
+				[]byte(`{"sub":"cross-test","msg":"combo"}`))
+			assertJWEDecrypts(t, token, keyPath, "cross-test", "combo")
 		})
 	}
 }
 
 func TestDecodeAndPrintJWE_A256KW_WithAllContentEncryptions(t *testing.T) {
-	contentEncs := []struct {
-		name string
-		enc  jose.ContentEncryption
-	}{
-		{"A128CBC-HS256", jose.A128CBC_HS256},
-		{"A192CBC-HS384", jose.A192CBC_HS384},
-		{"A256CBC-HS512", jose.A256CBC_HS512},
-		{"A128GCM", jose.A128GCM},
-		{"A192GCM", jose.A192GCM},
-		{"A256GCM", jose.A256GCM},
+	contentEncs := []jose.ContentEncryption{
+		jose.A128CBC_HS256,
+		jose.A192CBC_HS384,
+		jose.A256CBC_HS512,
+		jose.A128GCM,
+		jose.A192GCM,
+		jose.A256GCM,
 	}
 
-	symKey := make([]byte, 32)
-	if _, err := rand.Read(symKey); err != nil {
-		t.Fatalf("generating key: %v", err)
-	}
+	symKey := randomSymmetricKey(t, 32)
 	keyArg := symmetricKeyArg(t, symKey)
 
-	for _, tt := range contentEncs {
-		t.Run("A256KW/"+tt.name, func(t *testing.T) {
-			token := encryptJWEGeneric(t, jose.A256KW, tt.enc, symKey,
+	for _, enc := range contentEncs {
+		t.Run("A256KW/"+string(enc), func(t *testing.T) {
+			token := encryptJWEGeneric(t, jose.A256KW, enc, symKey,
 				[]byte(`{"sub":"a256kw-combo","result":"success"}`))
-
-			var buf bytes.Buffer
-			err := decodeAndPrintJWE(&buf, token, keyArg)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-
-			plain := stripANSI(buf.String())
-			if !strings.Contains(plain, "Decrypted Payload") {
-				t.Error("output missing Decrypted Payload")
-			}
-			if !strings.Contains(plain, "a256kw-combo") {
-				t.Error("output missing decrypted sub value")
-			}
-			if !strings.Contains(plain, "success") {
-				t.Error("output missing decrypted result value")
-			}
+			assertJWEDecrypts(t, token, keyArg, "a256kw-combo", "success")
 		})
 	}
 }

From 0a96c538fd130a72e56ab62c4810ccb5a0a262bc Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 21:22:47 +0200
Subject: [PATCH 5/6] test: report all assertOutputContains misses in one error

The helper's doc promised the output "once on a miss" but printed it per
missing substring, so a regression dropping a whole section dumped the same
output up to four times. Misses are now collected and reported together,
which also names every value the section took with it in one place.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 helpers_test.go | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/helpers_test.go b/helpers_test.go
index 1ba1b14..4c11967 100644
--- a/helpers_test.go
+++ b/helpers_test.go
@@ -17,6 +17,7 @@ import (
 	"math/big"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -311,15 +312,21 @@ func writeRSACertificateFiles(t *testing.T, key *rsa.PrivateKey) (pemPath, derPa
 // --- JWE algorithm-coverage assertions ---------------------------------------
 
 // assertOutputContains checks that every wanted substring appears in the
-// color-stripped output, reporting the whole output once on a miss.
+// color-stripped output. All misses are collected and reported together, so a
+// regression that drops a whole section names every value it took with it
+// without repeating the output per miss.
 func assertOutputContains(t *testing.T, out string, wants ...string) {
 	t.Helper()
 	plain := stripANSI(out)
+	var missing []string
 	for _, want := range wants {
 		if !strings.Contains(plain, want) {
-			t.Errorf("output missing %q:\n%s", want, plain)
+			missing = append(missing, strconv.Quote(want))
 		}
 	}
+	if len(missing) > 0 {
+		t.Errorf("output missing %s:\n%s", strings.Join(missing, ", "), plain)
+	}
 }
 
 // assertJWEHeaderOnly decodes a JWE without a key and asserts the header-only

From a66b0da4ed3c8b93e382f786960840dcc771ec4c Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 21:30:20 +0200
Subject: [PATCH 6/6] fix: keep the newline outside the colored verdict region

printVerdict formatted the trailing newline inside the color wrapper, so the
bold attribute spanned the line break; output truncated there (piped into
head, say) left the terminal with the attribute active. Fprintln puts the
newline after the reset, restoring the bytes the verdict lines had before
printVerdict was extracted.

Also move verifySignature into helpers_test.go. Production code always holds
a parsedJWT and calls printSignatureVerdict, so the string-taking wrapper had
no callers outside the tests and should not sit in the package as if it were
an entry point.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 AGENTS.md       |  2 +-
 helpers_test.go | 12 ++++++++++++
 main.go         | 12 ------------
 output.go       |  7 +++++--
 4 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 3629949..875dfdd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -18,7 +18,7 @@ All functionality lives in package `main`, split across six source files:
 - `readInteractive()` - Prompts for a token interactively using `chzyer/readline`
 - `decodeAndPrint()` / `printParsedJWT()` - `decodeAndPrint` parses the JWT with `golang-jwt/jwt` (`ParseUnverified`) and hands the result to `printParsedJWT`, which orchestrates output and verifies the signature when a key is provided. `printParsedJWT` runs `formatTimestamps` on a `maps.Clone` of the claims, so the display rewrite never touches the authoritative parse and the same `parsedJWT` can still be validated
 - `parsedJWT` / `parseUnverifiedJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data. `parseUnverifiedJWT` returns a `parsedJWT` (the raw string, token, segments, and claims) that is threaded through the decode, signature, and claim steps, so one run parses the token once instead of once per step
-- `verifyJWTSignature()` / `printSignatureVerdict()` / `verifySignature()` - `verifyJWTSignature` takes a `parsedJWT` and does the cryptographic check without printing, with `jwt.WithoutClaimsValidation()` so the result reflects only the signature, not expiry; it returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unusable key). `printSignatureVerdict` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero; `verifySignature` is the wrapper that parses first, for callers holding only the compact string. The `--json` path reuses the same core
+- `verifyJWTSignature()` / `printSignatureVerdict()` - `verifyJWTSignature` takes a `parsedJWT` and does the cryptographic check without printing, with `jwt.WithoutClaimsValidation()` so the result reflects only the signature, not expiry; it returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unusable key). `printSignatureVerdict` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero. The `--json` path reuses the same core. Production code always holds a `parsedJWT` at this point, so there is no string-taking wrapper in the package; the tests keep one (`verifySignature` in `helpers_test.go`) for the cases that start from a compact string
 - `publicKeyForVerification()` - Extracts the public key from RSA/ECDSA/Ed25519 private keys
 
 ### `jsonout.go` - Machine-readable `--json` output
diff --git a/helpers_test.go b/helpers_test.go
index 4c11967..feeb218 100644
--- a/helpers_test.go
+++ b/helpers_test.go
@@ -14,6 +14,7 @@ import (
 	"encoding/json"
 	"encoding/pem"
 	"fmt"
+	"io"
 	"math/big"
 	"os"
 	"path/filepath"
@@ -364,6 +365,17 @@ func randomSymmetricKey(t *testing.T, size int) []byte {
 	return key
 }
 
+// verifySignature parses a token and renders its signature verdict. Production
+// code always has a parsedJWT in hand and calls printSignatureVerdict directly;
+// this wrapper exists so the signature tests can work from a compact string.
+func verifySignature(w io.Writer, tokenStr, keyStr string) error {
+	p, err := parseUnverifiedJWT(tokenStr)
+	if err != nil {
+		return fmt.Errorf("signature verification: %w", err)
+	}
+	return printSignatureVerdict(w, p, keyStr)
+}
+
 // --- JWS signature verification -----------------------------------------------
 
 // signJWT creates a signed JWT with the given claims and RSA private key.
diff --git a/main.go b/main.go
index bda0aa8..0e568b0 100644
--- a/main.go
+++ b/main.go
@@ -335,18 +335,6 @@ func parseUnverifiedJWT(tokenStr string) (*parsedJWT, error) {
 	return &parsedJWT{raw: tokenStr, token: token, parts: parts, claims: claims}, nil
 }
 
-// verifySignature verifies a JWT signature using the provided key and prints
-// the result. It parses the token itself, for callers that hold only the
-// compact string; printSignatureVerdict is the variant for a token already
-// parsed.
-func verifySignature(w io.Writer, tokenStr, keyStr string) error {
-	p, err := parseUnverifiedJWT(tokenStr)
-	if err != nil {
-		return fmt.Errorf("signature verification: %w", err)
-	}
-	return printSignatureVerdict(w, p, keyStr)
-}
-
 // printSignatureVerdict renders the signature verdict for an already-parsed
 // token and returns the errInvalidSignature sentinel on failure so the CLI
 // exits nonzero.
diff --git a/output.go b/output.go
index 7f1fd77..0d25f45 100644
--- a/output.go
+++ b/output.go
@@ -270,11 +270,14 @@ func printSection(w io.Writer, f *prettyjson.Formatter, label string, data any)
 // independent verdicts (see AGENTS.md) but share this rendering, so they cannot
 // drift apart visually.
 func printVerdict(w io.Writer, label string, valid bool, reason string) error {
+	// The newline stays outside the colored region: Fprintln wraps the text
+	// and appends the newline after the reset, so output truncated at the line
+	// break cannot leave the attribute active in the terminal.
 	if valid {
-		_, err := color.New(color.FgGreen, color.Bold).Fprintf(w, "%s: VALID\n", label)
+		_, err := color.New(color.FgGreen, color.Bold).Fprintln(w, label+": VALID")
 		return err
 	}
-	if _, err := color.New(color.FgRed, color.Bold).Fprintf(w, "%s: INVALID\n", label); err != nil {
+	if _, err := color.New(color.FgRed, color.Bold).Fprintln(w, label+": INVALID"); err != nil {
 		return err
 	}
 	_, err := dimColor.Fprintf(w, "  %s\n", reason)