From a35582e74c027fad84c09887f50614b6ba550949 Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 22:39:03 +0200
Subject: [PATCH 1/2] perf: parse and verify each token once

The decode path decoded a token's header and claims three times on a
--key run: jwt.ParseUnverified decoded both segments, parseUnverifiedJWT
threw those away and redid them strictly, and verifyJWTSignature parsed
the whole compact string again just to reach the cryptography.

parseUnverifiedJWT now does the segment work itself and carries the
signing method and decoded signature bytes forward, so verification
calls SigningMethod.Verify over the segments it already has. The
algorithm allowlist jwt.WithValidMethods used to apply is now spelled
out explicitly and runs before Verify -- without it an HS256 token
signed with a published public key would verify against that key.

Both text escapers open with a byte-level plain-ASCII shortcut, the
shape predicates gained byte forms so a decrypted payload is not copied
just to be measured, and whole-second timestamps skip the big.Rat path.

On a 36 KB token: parse 346us -> 170us, verify 196us -> 19us, full
--key decode 1.15ms -> 0.74ms, and the escapers go from 287/664 MB/s to
about 4.1 GB/s on clean text. Behaviour is unchanged: stdout and stderr
are byte-identical across signed JWT, JWE, and malformed-token cases,
and only the wording of four malformed-JSON errors differs, now naming
the failing segment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 AGENTS.md      |  12 ++---
 jsonout.go     |   2 +-
 jwe.go         |  24 ++++++++-
 main.go        | 119 ++++++++++++++++++++++++++++++------------
 main_test.go   | 137 +++++++++++++++++++++++++++++++++++++++++++++++++
 output.go      | 115 ++++++++++++++++++++++++++++++-----------
 output_test.go |  62 ++++++++++++++++++++++
 7 files changed, 399 insertions(+), 72 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 875dfdd..e7ed04f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,9 +16,9 @@ All functionality lives in package `main`, split across six source files:
 - `headerKID()` - Extracts the token's `kid` header (or `""`) so JWK Set verification/decryption selects the key the token names
 - `printKeyInterpretation()` - Notes on stderr how a key argument was read when it was not read as a file, so precedence-based detection cannot silently take a value the user meant one way and use it another; adds the process-list exposure warning for `--key` values, which `JWTD_KEY` does not carry (`/proc/<pid>/cmdline` is world-readable, `/proc/<pid>/environ` is owner-only). Diagnostics go to stderr so stdout stays parseable
 - `readInteractive()` - Prompts for a token interactively using `chzyer/readline`
-- `decodeAndPrint()` / `printParsedJWT()` - `decodeAndPrint` parses the JWT with `golang-jwt/jwt` (`ParseUnverified`) and hands the result to `printParsedJWT`, which orchestrates output and verifies the signature when a key is provided. `printParsedJWT` runs `formatTimestamps` on a `maps.Clone` of the claims, so the display rewrite never touches the authoritative parse and the same `parsedJWT` can still be validated
-- `parsedJWT` / `parseUnverifiedJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data. `parseUnverifiedJWT` returns a `parsedJWT` (the raw string, token, segments, and claims) that is threaded through the decode, signature, and claim steps, so one run parses the token once instead of once per step
-- `verifyJWTSignature()` / `printSignatureVerdict()` - `verifyJWTSignature` takes a `parsedJWT` and does the cryptographic check without printing, with `jwt.WithoutClaimsValidation()` so the result reflects only the signature, not expiry; it returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unusable key). `printSignatureVerdict` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero. The `--json` path reuses the same core. Production code always holds a `parsedJWT` at this point, so there is no string-taking wrapper in the package; the tests keep one (`verifySignature` in `helpers_test.go`) for the cases that start from a compact string
+- `decodeAndPrint()` / `printParsedJWT()` - `decodeAndPrint` parses the JWT with `parseUnverifiedJWT` and hands the result to `printParsedJWT`, which orchestrates output and verifies the signature when a key is provided. `printParsedJWT` runs `formatTimestamps` on a `maps.Clone` of the claims, so the display rewrite never touches the authoritative parse and the same `parsedJWT` can still be validated
+- `parsedJWT` / `parseUnverifiedJWT()` / `splitCompactJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data. `parseUnverifiedJWT` returns a `parsedJWT` (the raw string, segments, decoded header and claims, signing method, and decoded signature bytes) that is threaded through the decode, signature, and claim steps, so one run parses the token once instead of once per step. It does the segment work itself rather than calling `jwt.ParseUnverified`, whose plain `json.Unmarshal` of the header and claims loses number precision and accepts trailing data — every one of its decodes would be discarded and redone strictly here. The remaining steps mirror `ParseUnverified` exactly, `splitCompactJWT`'s rejection of extra delimiters and the refusal of a missing or unknown `alg` included, so the set of tokens jwtd decodes is unchanged
+- `verifyJWTSignature()` / `validMethodsForKey()` / `printSignatureVerdict()` - `verifyJWTSignature` takes a `parsedJWT` and does the cryptographic check without printing, calling the parsed token's `SigningMethod.Verify` over its own segments rather than re-parsing the compact string through `jwt.Parse`; the claims are never consulted, so the result reflects only the signature, not expiry. **It must check the header `alg` against `validMethodsForKey` before verifying.** That allowlist is what `jwt.WithValidMethods` applied while verification went through `jwt.Parse`; verifying from an already-parsed token makes it jwtd's own check, and without it an HS256 token signed with the bytes of a published public key verifies against that key. `TestVerifyJWTSignature_RejectsAlgOutsideKeyTypeAllowlist` holds it down across every key type. `verifyJWTSignature` returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unusable key). `printSignatureVerdict` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero. The `--json` path reuses the same core. Production code always holds a `parsedJWT` at this point, so there is no string-taking wrapper in the package; the tests keep one (`verifySignature` in `helpers_test.go`) for the cases that start from a compact string
 - `publicKeyForVerification()` - Extracts the public key from RSA/ECDSA/Ed25519 private keys
 
 ### `jsonout.go` - Machine-readable `--json` output
@@ -36,7 +36,7 @@ All functionality lives in package `main`, split across six source files:
 
 ### `jwe.go` - JWE parsing and decryption
 
-- `isJWE()` / `isJWT()` - Detect JWE (5 dot-separated parts) and JWS/JWT (3 parts) compact serialization. Every token-shape dispatch goes through one of these two, so the shape rules are not restated inline
+- `isJWE()` / `isJWT()` / `isJWEBytes()` / `isJWTBytes()` - Detect JWE (5 dot-separated parts) and JWS/JWT (3 parts) compact serialization. Every token-shape dispatch goes through one of these, so the shape rules are not restated inline; all four read their delimiter counts from the `jweDelimiters`/`jwtDelimiters` constants, so the string and byte forms cannot disagree. The byte forms exist for `printDecryptedPayload`, where the candidate is a decrypted payload that may be large and must not be copied into a string just to be measured
 - `decodeAndPrintJWE()` / `jweProtectedHeaderMap()` - Parse a JWE with `go-jose` and decode every field in the compact protected header for display; without a key print encrypted part metadata, with a key decrypt and print the payload
 - `jweEncryptedParts()` / `printEncryptedParts()` / `partSize()` - Encrypted part metadata shown when no key is provided. `jweEncryptedParts` splits the compact serialization into its five segments for both the human and `--json` paths; `partSize` renders `base64URLLen`'s count (or its `-1`) as display text, so measuring and formatting are not implemented twice
 
@@ -54,8 +54,8 @@ Removing the fallback deleted the heuristics that existed only to decide it (`is
 
 ### `output.go` - Formatting, escaping, and colored printing
 
-- `printDecryptedPayload()` / `escapeTerminalText()` / `escapeFormattedJSONControls()` - Recursively decode nested JWTs/JWEs and pretty-print JSON objects or arrays; raw plaintext escapes C0 controls except newline/tab, DEL, C1 controls, invalid UTF-8 bytes, and targeted bidi controls, while formatted JSON sanitizes C1, DEL, and the same targeted bidi controls
-- `formatTimestamps()` / `timestampStatus()` / `humanizeDuration()` - Convert exact `iat`, `exp`, `nbf` Unix numeric values, including fractions, to RFC3339 strings (original value shown in parentheses); `exp` is annotated with the time remaining or elapsed (`expires in 14m` / `expired 2h ago`) and a future `nbf` with `not yet valid, in 5m` (an already-valid `nbf` gets no note). `humanizeDuration` renders the largest whole unit (s/m/h/d), truncating toward zero for deterministic output. This is display-only and never affects verification or the exit code; `timeNow` is a package variable so the annotations are testable. The `--json` path skips this entirely and keeps raw numeric claims
+- `printDecryptedPayload()` / `escapeTerminalText()` / `escapeFormattedJSONControls()` / `isPlainASCIIText()` - Recursively decode nested JWTs/JWEs and pretty-print JSON objects or arrays; raw plaintext escapes C0 controls except newline/tab, DEL, C1 controls, invalid UTF-8 bytes, and targeted bidi controls, while formatted JSON sanitizes C1, DEL, and the same targeted bidi controls. Both escapers open with the `isPlainASCIIText` shortcut, which returns text that is entirely printable ASCII (plus newline and tab) as a single copy instead of rebuilding it rune by rune — a decrypted payload is unbounded in size, and this is the only path that prints one verbatim. The scan is deliberately **byte-level, not `bytes.ContainsFunc`**: rune decoding maps every invalid UTF-8 byte to `RuneError`, which no escape predicate matches, so a rune-level fast path would wave malformed bytes through unescaped
+- `formatTimestamps()` / `claimTime()` / `representableTime()` / `timestampStatus()` / `humanizeDuration()` - Convert exact `iat`, `exp`, `nbf` Unix numeric values, including fractions, to RFC3339 strings (original value shown in parentheses); `exp` is annotated with the time remaining or elapsed (`expires in 14m` / `expired 2h ago`) and a future `nbf` with `not yet valid, in 5m` (an already-valid `nbf` gets no note). `claimTime` does the conversion: it re-validates the literal as JSON (a `json.Number` can hold arbitrary text, and `big.Rat.SetString` accepts ratios, hex, and binary exponents that JSON does not), then converts whole seconds with `strconv.ParseInt` and falls back to the exact `big.Rat` path only for the fractional and exponent forms, which cost about thirty allocations per claim. `humanizeDuration` renders the largest whole unit (s/m/h/d), truncating toward zero for deterministic output. This is display-only and never affects verification or the exit code; `timeNow` is a package variable so the annotations are testable. The `--json` path skips this entirely and keeps raw numeric claims
 - `newFormatter()` - Creates a `go-prettyjson` formatter with the project color scheme
 - `printSection()` / `printSignature()` / `printVerdict()` - Formatted output using `fatih/color`. `printSection` takes any JSON-marshalable value, so objects and arrays share one path; `printVerdict` renders the `<label>: VALID`/`INVALID` line with its dim reason, shared by the independent signature and claim verdicts so they cannot drift apart visually
 
diff --git a/jsonout.go b/jsonout.go
index 7a55a69..3acf8c2 100644
--- a/jsonout.go
+++ b/jsonout.go
@@ -50,7 +50,7 @@ func decodeJWTJSON(w io.Writer, tokenStr, keyStr string, checks claimChecks) err
 	}
 
 	out := jwtJSON{
-		Header:    p.token.Header,
+		Header:    p.header,
 		Payload:   map[string]any(p.claims),
 		Signature: p.parts[2],
 	}
diff --git a/jwe.go b/jwe.go
index 2159a17..1c102c4 100644
--- a/jwe.go
+++ b/jwe.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/base64"
 	"fmt"
 	"io"
@@ -41,17 +42,36 @@ var allContentEncryptions = []jose.ContentEncryption{
 	jose.A256GCM,
 }
 
+// Compact serializations are told apart by their delimiter count: a JWE has
+// five parts, a JWS/JWT three. The counts live here so the string and byte
+// forms of the predicates below cannot disagree about the shape rule.
+const (
+	jweDelimiters = 4
+	jwtDelimiters = 2
+)
+
 // isJWE returns true if the token string looks like a JWE compact serialization
 // (5 dot-separated parts) rather than a JWT (3 parts).
 func isJWE(token string) bool {
-	return strings.Count(token, ".") == 4
+	return strings.Count(token, ".") == jweDelimiters
 }
 
 // isJWT returns true if the token string looks like a JWS/JWT compact
 // serialization (3 dot-separated parts). It is the counterpart of isJWE, so
 // token-shape dispatch has one definition per form.
 func isJWT(token string) bool {
-	return strings.Count(token, ".") == 2
+	return strings.Count(token, ".") == jwtDelimiters
+}
+
+// isJWEBytes and isJWTBytes are the byte forms, used where the candidate is a
+// decrypted payload that may be large: testing its shape must not cost a full
+// copy of it just to reach the string predicates.
+func isJWEBytes(token []byte) bool {
+	return bytes.Count(token, []byte(".")) == jweDelimiters
+}
+
+func isJWTBytes(token []byte) bool {
+	return bytes.Count(token, []byte(".")) == jwtDelimiters
 }
 
 // decodeAndPrintJWE parses a JWE token and prints its contents.
diff --git a/main.go b/main.go
index 0e568b0..9ffedd9 100644
--- a/main.go
+++ b/main.go
@@ -5,12 +5,14 @@ import (
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/rsa"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"maps"
 	"os"
+	"slices"
 	"strings"
 
 	"github.com/chzyer/readline"
@@ -259,7 +261,7 @@ func decodeAndPrint(w io.Writer, tokenStr, keyStr string) error {
 func printParsedJWT(w io.Writer, p *parsedJWT, keyStr string) error {
 	f := newFormatter()
 
-	if err := printSection(w, f, "Header", p.token.Header); err != nil {
+	if err := printSection(w, f, "Header", p.header); err != nil {
 		return err
 	}
 	if _, err := fmt.Fprintln(w); err != nil {
@@ -291,39 +293,47 @@ func printParsedJWT(w io.Writer, p *parsedJWT, keyStr string) error {
 	return nil
 }
 
-// parsedJWT is one strict decode of a compact JWT: the token with its
-// display-decoded header, its three segments, and its claims. It is threaded
-// through the decode, signature, and claim steps so a single run parses the
-// token once rather than once per step.
+// parsedJWT is one strict decode of a compact JWT: its three segments, the
+// display-decoded header and claims, and the signing method and decoded
+// signature bytes the verification step needs. It is threaded through the
+// decode, signature, and claim steps so a single run parses the token once
+// rather than once per step.
 type parsedJWT struct {
-	raw    string
-	token  *jwt.Token
-	parts  []string
-	claims jwt.MapClaims
+	raw       string
+	header    map[string]any
+	parts     []string
+	claims    jwt.MapClaims
+	method    jwt.SigningMethod
+	signature []byte
 }
 
+// parseUnverifiedJWT decodes a compact JWT without checking its signature.
+//
+// It does the segment work itself rather than calling jwt.ParseUnverified,
+// which JSON-decodes the header and claims with plain json.Unmarshal — losing
+// number precision and accepting trailing data — so every one of its decodes
+// would be thrown away and redone strictly here. The remaining steps mirror
+// ParseUnverified exactly, including its rejection of a token whose "alg" is
+// missing or unknown, so the set of tokens jwtd decodes is unchanged.
 func parseUnverifiedJWT(tokenStr string) (*parsedJWT, error) {
-	parser := jwt.NewParser(jwt.WithJSONNumber())
-	token, parts, err := parser.ParseUnverified(tokenStr, jwt.MapClaims{})
-	if err != nil {
-		return nil, fmt.Errorf("parsing JWT: %w", err)
+	parts, ok := splitCompactJWT(tokenStr)
+	if !ok {
+		return nil, fmt.Errorf("parsing JWT: %w: token contains an invalid number of segments", jwt.ErrTokenMalformed)
 	}
 
-	headerData, err := parser.DecodeSegment(parts[0])
+	headerData, err := base64.RawURLEncoding.DecodeString(parts[0])
 	if err != nil {
 		return nil, fmt.Errorf("parsing JWT header: decoding header: %w", err)
 	}
 
-	// Re-decode the header for display with the same strictness as the
-	// claims: exact json.Number values and no trailing data. ParseUnverified
-	// decodes it with plain json.Unmarshal, which loses number precision.
+	// The header is decoded with the same strictness as the claims: exact
+	// json.Number values and no trailing data.
 	header := map[string]any{}
 	if err := decodeJSON(headerData, &header); err != nil {
 		return nil, fmt.Errorf("parsing JWT header: %w", err)
 	}
-	token.Header = header
 
-	payload, err := parser.DecodeSegment(parts[1])
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
 		return nil, fmt.Errorf("parsing JWT claims: decoding payload: %w", err)
 	}
@@ -332,7 +342,45 @@ func parseUnverifiedJWT(tokenStr string) (*parsedJWT, error) {
 	if err := decodeJSON(payload, &claims); err != nil {
 		return nil, fmt.Errorf("parsing JWT claims: %w", err)
 	}
-	return &parsedJWT{raw: tokenStr, token: token, parts: parts, claims: claims}, nil
+
+	alg, ok := header["alg"].(string)
+	if !ok {
+		return nil, fmt.Errorf("parsing JWT: %w: signing method (alg) is unspecified", jwt.ErrTokenUnverifiable)
+	}
+	method := jwt.GetSigningMethod(alg)
+	if method == nil {
+		return nil, fmt.Errorf("parsing JWT: %w: signing method (alg) is unavailable", jwt.ErrTokenUnverifiable)
+	}
+
+	signature, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return nil, fmt.Errorf("parsing JWT: %w: could not base64 decode signature: %w", jwt.ErrTokenMalformed, err)
+	}
+
+	return &parsedJWT{
+		raw:       tokenStr,
+		header:    header,
+		parts:     parts,
+		claims:    claims,
+		method:    method,
+		signature: signature,
+	}, nil
+}
+
+// splitCompactJWT splits a compact serialization into its three segments,
+// reporting false unless there are exactly two delimiters. A token carrying
+// extra delimiters is rejected rather than truncated, matching
+// jwt.ParseUnverified.
+func splitCompactJWT(tokenStr string) ([]string, bool) {
+	header, remain, ok := strings.Cut(tokenStr, ".")
+	if !ok {
+		return nil, false
+	}
+	claims, signature, ok := strings.Cut(remain, ".")
+	if !ok || strings.Contains(signature, ".") {
+		return nil, false
+	}
+	return []string{header, claims, signature}, true
 }
 
 // printSignatureVerdict renders the signature verdict for an already-parsed
@@ -360,7 +408,7 @@ func printSignatureVerdict(w io.Writer, p *parsedJWT, keyStr string) error {
 // hard failures (unparseable token, unusable key) that are not a verdict on the
 // signature itself.
 func verifyJWTSignature(p *parsedJWT, keyStr string) (valid bool, reason error, err error) {
-	key, err := loadKeyForKID(keyStr, headerKID(p.token.Header))
+	key, err := loadKeyForKID(keyStr, headerKID(p.header))
 	if err != nil {
 		return false, nil, fmt.Errorf("error loading key: %w", err)
 	}
@@ -368,19 +416,22 @@ func verifyJWTSignature(p *parsedJWT, keyStr string) (valid bool, reason error,
 	// Extract the public key from private keys for verification.
 	key = publicKeyForVerification(key)
 
-	// Claims validation is disabled so the result reflects only the
-	// cryptographic signature, not token expiry. Accepted algorithms are
-	// restricted to those compatible with the key type to rule out
-	// algorithm confusion.
-	opts := []jwt.ParserOption{jwt.WithoutClaimsValidation(), jwt.WithJSONNumber()}
-	if methods := validMethodsForKey(key); methods != nil {
-		opts = append(opts, jwt.WithValidMethods(methods))
-	}
-	parser := jwt.NewParser(opts...)
-	if _, perr := parser.Parse(p.raw, func(*jwt.Token) (any, error) {
-		return key, nil
-	}); perr != nil {
-		return false, perr, nil
+	// Accepted algorithms are restricted to those compatible with the key type
+	// to rule out algorithm confusion. This check is what jwt.WithValidMethods
+	// would do inside jwt.Parse; verifying from the already-parsed token means
+	// it has to be spelled out here, and it must stay ahead of the Verify call
+	// below — without it an HS256 token signed with a published public key
+	// verifies against that key.
+	alg := p.method.Alg()
+	if methods := validMethodsForKey(key); methods != nil && !slices.Contains(methods, alg) {
+		return false, fmt.Errorf("%w: signing method %v is invalid", jwt.ErrTokenSignatureInvalid, alg), nil
+	}
+
+	// Only the signature is checked here: the claims are never consulted, so
+	// the verdict reflects the cryptography alone and not token expiry.
+	signingInput := p.parts[0] + "." + p.parts[1]
+	if verr := p.method.Verify(signingInput, p.signature, key); verr != nil {
+		return false, fmt.Errorf("%w: %w", jwt.ErrTokenSignatureInvalid, verr), nil
 	}
 	return true, nil, nil
 }
diff --git a/main_test.go b/main_test.go
index eac68fa..bdcb425 100644
--- a/main_test.go
+++ b/main_test.go
@@ -1129,3 +1129,140 @@ func TestPrintExecutionError_SuppressesInvalidSignature(t *testing.T) {
 		t.Fatalf("expected no duplicate invalid signature error, got %q", stderr.String())
 	}
 }
+
+// TestVerifyJWTSignature_RejectsAlgOutsideKeyTypeAllowlist pins the algorithm
+// restriction across every supported key type. Verification runs from the
+// already-parsed token rather than through jwt.Parse, so the allowlist that
+// jwt.WithValidMethods used to apply is now jwtd's own check: without it, an
+// HS256 token signed with the bytes of a published public key would verify
+// against that key.
+func TestVerifyJWTSignature_RejectsAlgOutsideKeyTypeAllowlist(t *testing.T) {
+	rsaKey := generateRSAKey(t)
+	ecKey := generateECKey(t)
+	edKey := generateEd25519Key(t)
+	secret := []byte("a-shared-secret-of-sufficient-len")
+
+	hmacToken := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "test"})
+	rsaToken := signJWT(t, rsaKey, jwt.MapClaims{"sub": "test"})
+
+	tests := []struct {
+		name    string
+		token   string
+		keyArg  string
+		wantAlg string
+	}{
+		{
+			name:    "HS256 token against RSA public key",
+			token:   hmacToken,
+			keyArg:  writeRSAPublicKeyFile(t, &rsaKey.PublicKey),
+			wantAlg: "HS256",
+		},
+		{
+			name:    "HS256 token against EC public key",
+			token:   hmacToken,
+			keyArg:  writeECPublicKeyFile(t, &ecKey.PublicKey),
+			wantAlg: "HS256",
+		},
+		{
+			name:    "HS256 token against Ed25519 key",
+			token:   hmacToken,
+			keyArg:  writeEd25519KeyFile(t, edKey),
+			wantAlg: "HS256",
+		},
+		{
+			name:    "RS256 token against symmetric secret",
+			token:   rsaToken,
+			keyArg:  "raw:" + string(secret),
+			wantAlg: "RS256",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p, err := parseUnverifiedJWT(tt.token)
+			if err != nil {
+				t.Fatalf("unexpected parse error: %v", err)
+			}
+
+			valid, reason, err := verifyJWTSignature(p, tt.keyArg)
+			if err != nil {
+				t.Fatalf("unexpected hard error: %v", err)
+			}
+			if valid {
+				t.Fatal("signature accepted for an algorithm the key type cannot carry")
+			}
+			want := "signing method " + tt.wantAlg + " is invalid"
+			if reason == nil || !strings.Contains(reason.Error(), want) {
+				t.Errorf("expected %q in reason, got: %v", want, reason)
+			}
+		})
+	}
+}
+
+// TestParseUnverifiedJWT_RejectsMalformedTokens pins the token shapes the
+// decoder refuses. parseUnverifiedJWT splits and decodes the segments itself
+// instead of calling jwt.ParseUnverified, so these rejections are jwtd's own
+// and must not quietly widen.
+func TestParseUnverifiedJWT_RejectsMalformedTokens(t *testing.T) {
+	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"HS256"}`))
+	payload := base64.RawURLEncoding.EncodeToString([]byte(`{"sub":"test"}`))
+
+	tests := []struct {
+		name  string
+		token string
+		want  string
+	}{
+		{name: "no delimiters", token: "notatoken", want: "invalid number of segments"},
+		{name: "two segments", token: header + "." + payload, want: "invalid number of segments"},
+		{name: "four segments", token: header + "." + payload + ".sig.extra", want: "invalid number of segments"},
+		{name: "unknown alg", token: base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"NOPE"}`)) + "." + payload + ".sig", want: "signing method (alg) is unavailable"},
+		{name: "missing alg", token: base64.RawURLEncoding.EncodeToString([]byte(`{"typ":"JWT"}`)) + "." + payload + ".sig", want: "signing method (alg) is unspecified"},
+		{name: "signature not base64url", token: header + "." + payload + "._!!_", want: "could not base64 decode signature"},
+		{name: "header not base64url", token: "_!!_." + payload + ".sig", want: "decoding header"},
+		{name: "payload not base64url", token: header + "._!!_.sig", want: "decoding payload"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p, err := parseUnverifiedJWT(tt.token)
+			if err == nil {
+				t.Fatalf("expected error, got a parsed token: %+v", p)
+			}
+			if !strings.Contains(err.Error(), tt.want) {
+				t.Errorf("expected %q in error, got: %v", tt.want, err)
+			}
+		})
+	}
+}
+
+// TestParseUnverifiedJWT_DecodesSegmentsOnce checks that the parsed token
+// carries everything the later steps need, so neither the signature check nor
+// claim validation has to decode the token a second time.
+func TestParseUnverifiedJWT_DecodesSegmentsOnce(t *testing.T) {
+	secret := []byte("a-shared-secret-of-sufficient-len")
+	token := signJWTWithHMAC(t, secret, jwt.MapClaims{"sub": "test"})
+
+	p, err := parseUnverifiedJWT(token)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if got := p.header["alg"]; got != "HS256" {
+		t.Errorf("expected HS256 header alg, got %v", got)
+	}
+	if p.method == nil || p.method.Alg() != "HS256" {
+		t.Errorf("expected HS256 signing method, got %v", p.method)
+	}
+	if len(p.signature) == 0 {
+		t.Error("expected decoded signature bytes")
+	}
+	if got, _ := p.claims["sub"].(string); got != "test" {
+		t.Errorf("expected sub claim, got %v", p.claims["sub"])
+	}
+	if len(p.parts) != 3 {
+		t.Fatalf("expected 3 segments, got %d", len(p.parts))
+	}
+	if p.parts[0]+"."+p.parts[1]+"."+p.parts[2] != token {
+		t.Error("segments do not reassemble into the original token")
+	}
+}
diff --git a/output.go b/output.go
index 0d25f45..fca7390 100644
--- a/output.go
+++ b/output.go
@@ -44,22 +44,24 @@ func newFormatter() *prettyjson.Formatter {
 // If the plaintext is valid JSON, it is pretty-printed. If the plaintext
 // is itself a JWT or JWE, it is decoded and printed recursively.
 func printDecryptedPayload(w io.Writer, f *prettyjson.Formatter, plaintext []byte) error {
-	text := string(plaintext)
+	// The shape checks run on the bytes, so a payload that is not a nested
+	// token — the common case, and the one that can be large — is never copied
+	// into a string just to be measured.
 
 	// Check if the decrypted payload is a nested JWE. The nested output is
 	// buffered so nothing is printed if decoding fails and the payload falls
 	// through to the JSON/raw handling below.
-	if isJWE(text) {
+	if isJWEBytes(plaintext) {
 		var nested bytes.Buffer
-		if err := decodeAndPrintJWE(&nested, text, ""); err == nil {
+		if err := decodeAndPrintJWE(&nested, string(plaintext), ""); err == nil {
 			return printNestedPayload(w, "Decrypted Payload (nested JWE)", nested.Bytes())
 		}
 	}
 
 	// Check if the decrypted payload is a nested JWT.
-	if isJWT(text) {
+	if isJWTBytes(plaintext) {
 		var nested bytes.Buffer
-		if err := decodeAndPrint(&nested, text, ""); err == nil {
+		if err := decodeAndPrint(&nested, string(plaintext), ""); err == nil {
 			return printNestedPayload(w, "Decrypted Payload (nested JWT)", nested.Bytes())
 		}
 	}
@@ -86,6 +88,14 @@ func printDecryptedPayload(w io.Writer, f *prettyjson.Formatter, plaintext []byt
 }
 
 func escapeTerminalText(text []byte) string {
+	// Fast path: text that is entirely printable ASCII (plus the newline and
+	// tab that pass through anyway) is returned as one copy instead of being
+	// rebuilt rune by rune. A decrypted JWE payload can be arbitrarily large,
+	// and this is the only path that prints one verbatim.
+	if isPlainASCIIText(text) {
+		return string(text)
+	}
+
 	var escaped strings.Builder
 	escaped.Grow(len(text))
 	for len(text) > 0 {
@@ -114,6 +124,12 @@ func escapeTerminalText(text []byte) string {
 }
 
 func escapeFormattedJSONControls(text []byte) string {
+	// Every rune needsJSONEscape rewrites is DEL or above, so pure ASCII text
+	// is settled by a byte scan without decoding a single rune; anything else
+	// falls through to the rune-level check.
+	if isPlainASCIIText(text) {
+		return string(text)
+	}
 	if !bytes.ContainsFunc(text, needsJSONEscape) {
 		return string(text)
 	}
@@ -132,6 +148,21 @@ func escapeFormattedJSONControls(text []byte) string {
 	return escaped.String()
 }
 
+// isPlainASCIIText reports whether text is entirely printable ASCII, plus the
+// newline and tab that both escapers pass through untouched. Such text needs no
+// escaping in either form, and deciding it byte by byte avoids decoding runes.
+// Every case the escapers do rewrite — the other C0 controls, DEL, the C1
+// controls, the bidi controls, and invalid UTF-8 — has at least one byte
+// outside that range, so a false result only ever costs a slow-path pass.
+func isPlainASCIIText(text []byte) bool {
+	for _, b := range text {
+		if b >= 0x7f || (b < 0x20 && b != '\n' && b != '\t') {
+			return false
+		}
+	}
+	return true
+}
+
 // needsJSONEscape reports whether a rune must be escaped in already-formatted
 // JSON: DEL, the C1 controls, and the targeted bidi controls.
 func needsJSONEscape(r rune) bool {
@@ -174,33 +205,10 @@ func formatTimestamps(data map[string]any) {
 			continue
 		}
 
-		// A json.Number can be constructed with arbitrary text, so the value
-		// is re-validated as a JSON number literal here: big.Rat.SetString
-		// also accepts forms JSON does not (ratios, hex, binary exponents).
-		if len(text) == 0 || (text[0] != '-' && (text[0] < '0' || text[0] > '9')) || !json.Valid([]byte(text)) {
-			continue
-		}
-		epoch, ok := new(big.Rat).SetString(text)
+		t, ok := claimTime(text)
 		if !ok {
 			continue
 		}
-
-		seconds := new(big.Int).Quo(epoch.Num(), epoch.Denom())
-		if !seconds.IsInt64() {
-			continue
-		}
-
-		remainder := new(big.Rat).Sub(epoch, new(big.Rat).SetInt(seconds))
-		nanoseconds := new(big.Rat).Mul(remainder, big.NewRat(int64(time.Second), 1))
-		nanos := new(big.Int).Quo(nanoseconds.Num(), nanoseconds.Denom())
-		if !nanos.IsInt64() {
-			continue
-		}
-
-		t := time.Unix(seconds.Int64(), nanos.Int64()).UTC()
-		if t.Year() < 0 || t.Year() > 9999 {
-			continue
-		}
 		if status := timestampStatus(key, t); status != "" {
 			data[key] = fmt.Sprintf("%s (%s, %s)", t.Format(time.RFC3339Nano), text, status)
 		} else {
@@ -209,6 +217,55 @@ func formatTimestamps(data map[string]any) {
 	}
 }
 
+// claimTime converts a numeric claim literal to the instant it denotes,
+// reporting false for anything that is not a JSON number naming a
+// representable time.
+//
+// A json.Number can be constructed with arbitrary text, so the value is
+// re-validated as a JSON number literal first: big.Rat.SetString also accepts
+// forms JSON does not (ratios, hex, binary exponents).
+func claimTime(text string) (time.Time, bool) {
+	if len(text) == 0 || (text[0] != '-' && (text[0] < '0' || text[0] > '9')) || !json.Valid([]byte(text)) {
+		return time.Time{}, false
+	}
+
+	// Whole seconds, which every ordinary token uses, are converted directly.
+	// The big.Rat path below exists for the fractional and exponent forms JSON
+	// also permits, and costs roughly thirty allocations per claim.
+	if seconds, err := strconv.ParseInt(text, 10, 64); err == nil {
+		return representableTime(time.Unix(seconds, 0))
+	}
+
+	epoch, ok := new(big.Rat).SetString(text)
+	if !ok {
+		return time.Time{}, false
+	}
+
+	seconds := new(big.Int).Quo(epoch.Num(), epoch.Denom())
+	if !seconds.IsInt64() {
+		return time.Time{}, false
+	}
+
+	remainder := new(big.Rat).Sub(epoch, new(big.Rat).SetInt(seconds))
+	nanoseconds := new(big.Rat).Mul(remainder, big.NewRat(int64(time.Second), 1))
+	nanos := new(big.Int).Quo(nanoseconds.Num(), nanoseconds.Denom())
+	if !nanos.IsInt64() {
+		return time.Time{}, false
+	}
+
+	return representableTime(time.Unix(seconds.Int64(), nanos.Int64()))
+}
+
+// representableTime rejects instants outside the four-digit year range
+// RFC3339 can render.
+func representableTime(t time.Time) (time.Time, bool) {
+	t = t.UTC()
+	if t.Year() < 0 || t.Year() > 9999 {
+		return time.Time{}, false
+	}
+	return t, true
+}
+
 // timestampStatus returns an informational note describing a claim's time
 // relative to now: an "exp" is annotated with how long ago it expired or how
 // long until it does, and an "nbf" still in the future with how long until it
diff --git a/output_test.go b/output_test.go
index 11c0c13..0c728d8 100644
--- a/output_test.go
+++ b/output_test.go
@@ -532,3 +532,65 @@ func TestPrintSignature_LabelsOnSeparateLines(t *testing.T) {
 		t.Errorf("second line should be 'mysig', got %q", lines[1])
 	}
 }
+
+// TestEscapeTerminalText_FastPathMatchesSlowPath pins that the plain-ASCII
+// shortcut in escapeTerminalText is a pure optimization: text it accepts must
+// come back exactly as the rune-by-rune path would have produced it, and text
+// needing any escape must not reach it.
+func TestEscapeTerminalText_FastPathMatchesSlowPath(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []byte
+		wantFast bool
+	}{
+		{name: "printable ascii", input: []byte("plain ascii payload"), wantFast: true},
+		{name: "newlines and tabs", input: []byte("a\tb\nc"), wantFast: true},
+		{name: "empty", input: nil, wantFast: true},
+		{name: "escape sequence", input: []byte("a\x1b[31mb"), wantFast: false},
+		{name: "del", input: []byte("a\x7fb"), wantFast: false},
+		{name: "c1 control", input: []byte("a\u009db"), wantFast: false},
+		{name: "bidi control", input: []byte("a\u202eb"), wantFast: false},
+		{name: "invalid utf-8", input: []byte{'a', 0xff, 'b'}, wantFast: false},
+		{name: "valid multibyte", input: []byte("a\u00e4b"), wantFast: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isPlainASCIIText(tt.input); got != tt.wantFast {
+				t.Errorf("isPlainASCIIText = %v, want %v", got, tt.wantFast)
+			}
+			if tt.wantFast {
+				if got := escapeTerminalText(tt.input); got != string(tt.input) {
+					t.Errorf("fast path altered text: got %q, want %q", got, tt.input)
+				}
+			}
+		})
+	}
+}
+
+// TestFormatTimestamps_IntegerAndFractionalAgree pins that the whole-second
+// shortcut in claimTime renders the same instant as the exact big.Rat path it
+// bypasses.
+func TestFormatTimestamps_IntegerAndFractionalAgree(t *testing.T) {
+	tests := []struct {
+		integer    string
+		fractional string
+	}{
+		{integer: "1516239022", fractional: "1516239022.0"},
+		{integer: "0", fractional: "0.0"},
+		{integer: "-1", fractional: "-1.0"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.integer, func(t *testing.T) {
+			whole, wholeOK := claimTime(tt.integer)
+			fraction, fractionOK := claimTime(tt.fractional)
+			if !wholeOK || !fractionOK {
+				t.Fatalf("expected both forms to convert, got %v and %v", wholeOK, fractionOK)
+			}
+			if !whole.Equal(fraction) {
+				t.Errorf("integer path gave %v, fractional path gave %v", whole, fraction)
+			}
+		})
+	}
+}

From e5263192323b22bd38b107feaaa3ae7e4cf94f34 Mon Sep 17 00:00:00 2001
From: David Henning <david@webcodr.io>
Date: Thu, 27 Aug 2026 22:47:38 +0200
Subject: [PATCH 2/2] refactor: drop parsedJWT.raw, which no longer has a
 reader

Verification used to re-parse the compact string through jwt.Parse, and
that was the only thing reading the field. Nothing reads it now, and an
unread struct field draws no compiler or vet diagnostic, so it would
quietly rot out of step with the doc comment. The segments still
reassemble into the original token where a caller needs it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q26LwBBSBPUpbf1kd4Ep3z
---
 AGENTS.md | 2 +-
 main.go   | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index e7ed04f..21002eb 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,7 +17,7 @@ All functionality lives in package `main`, split across six source files:
 - `printKeyInterpretation()` - Notes on stderr how a key argument was read when it was not read as a file, so precedence-based detection cannot silently take a value the user meant one way and use it another; adds the process-list exposure warning for `--key` values, which `JWTD_KEY` does not carry (`/proc/<pid>/cmdline` is world-readable, `/proc/<pid>/environ` is owner-only). Diagnostics go to stderr so stdout stays parseable
 - `readInteractive()` - Prompts for a token interactively using `chzyer/readline`
 - `decodeAndPrint()` / `printParsedJWT()` - `decodeAndPrint` parses the JWT with `parseUnverifiedJWT` and hands the result to `printParsedJWT`, which orchestrates output and verifies the signature when a key is provided. `printParsedJWT` runs `formatTimestamps` on a `maps.Clone` of the claims, so the display rewrite never touches the authoritative parse and the same `parsedJWT` can still be validated
-- `parsedJWT` / `parseUnverifiedJWT()` / `splitCompactJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data. `parseUnverifiedJWT` returns a `parsedJWT` (the raw string, segments, decoded header and claims, signing method, and decoded signature bytes) that is threaded through the decode, signature, and claim steps, so one run parses the token once instead of once per step. It does the segment work itself rather than calling `jwt.ParseUnverified`, whose plain `json.Unmarshal` of the header and claims loses number precision and accepts trailing data — every one of its decodes would be discarded and redone strictly here. The remaining steps mirror `ParseUnverified` exactly, `splitCompactJWT`'s rejection of extra delimiters and the refusal of a missing or unknown `alg` included, so the set of tokens jwtd decodes is unchanged
+- `parsedJWT` / `parseUnverifiedJWT()` / `splitCompactJWT()` / `decodeJSON()` - Strictly decode the header, claims, and other displayed JSON with exact `json.Number` values and reject malformed or trailing JSON data. `parseUnverifiedJWT` returns a `parsedJWT` (the segments, decoded header and claims, signing method, and decoded signature bytes) that is threaded through the decode, signature, and claim steps, so one run parses the token once instead of once per step. It does the segment work itself rather than calling `jwt.ParseUnverified`, whose plain `json.Unmarshal` of the header and claims loses number precision and accepts trailing data — every one of its decodes would be discarded and redone strictly here. The remaining steps mirror `ParseUnverified` exactly, `splitCompactJWT`'s rejection of extra delimiters and the refusal of a missing or unknown `alg` included, so the set of tokens jwtd decodes is unchanged
 - `verifyJWTSignature()` / `validMethodsForKey()` / `printSignatureVerdict()` - `verifyJWTSignature` takes a `parsedJWT` and does the cryptographic check without printing, calling the parsed token's `SigningMethod.Verify` over its own segments rather than re-parsing the compact string through `jwt.Parse`; the claims are never consulted, so the result reflects only the signature, not expiry. **It must check the header `alg` against `validMethodsForKey` before verifying.** That allowlist is what `jwt.WithValidMethods` applied while verification went through `jwt.Parse`; verifying from an already-parsed token makes it jwtd's own check, and without it an HS256 token signed with the bytes of a published public key verifies against that key. `TestVerifyJWTSignature_RejectsAlgOutsideKeyTypeAllowlist` holds it down across every key type. `verifyJWTSignature` returns `valid`, an invalid-signature `reason`, and a separate hard `err` (unusable key). `printSignatureVerdict` renders `Signature: VALID`/`INVALID` from it and returns the `errInvalidSignature` sentinel on failure so the CLI exits nonzero. The `--json` path reuses the same core. Production code always holds a `parsedJWT` at this point, so there is no string-taking wrapper in the package; the tests keep one (`verifySignature` in `helpers_test.go`) for the cases that start from a compact string
 - `publicKeyForVerification()` - Extracts the public key from RSA/ECDSA/Ed25519 private keys
 
diff --git a/main.go b/main.go
index 9ffedd9..8e40a3f 100644
--- a/main.go
+++ b/main.go
@@ -299,7 +299,6 @@ func printParsedJWT(w io.Writer, p *parsedJWT, keyStr string) error {
 // decode, signature, and claim steps so a single run parses the token once
 // rather than once per step.
 type parsedJWT struct {
-	raw       string
 	header    map[string]any
 	parts     []string
 	claims    jwt.MapClaims
@@ -358,7 +357,6 @@ func parseUnverifiedJWT(tokenStr string) (*parsedJWT, error) {
 	}
 
 	return &parsedJWT{
-		raw:       tokenStr,
 		header:    header,
 		parts:     parts,
 		claims:    claims,