for token in tokens: if not token.strip(): continue payload = decode_jws_payload(token) # If no fields specified, take all top-level keys if fields_of_interest is None: rows.append(payload) else: filtered = field: payload.get(field, None) for field in fields_of_interest rows.append(filtered)
To flatten these into CSV columns (e.g., user.id , permissions.0 ), you can use pandas.json_normalize() instead of the direct DataFrame constructor. jws to csv converter
from pandas import json_normalize normalized = json_normalize(payload) rows.append(normalized.iloc[0].to_dict()) What About Invalid or Expired Signatures? A pure converter doesn’t need to verify the signature – it just decodes the payload. However, you may want to add a signature_valid column using a cryptographic library (e.g., cryptography or jwt with verification disabled first, then verified separately). for token in tokens: if not token
Opening a raw .log file full of base64url-encoded strings isn’t practical. But dropping that data into a CSV? Now you can sort, filter, and pivot. However, you may want to add a signature_valid
Do not trust the claims from an unverified JWS in a security context. For analysis, it’s fine. For access control, always verify the signature. Real-World Example Input ( tokens.txt ):
Extend the script to handle JWE (encrypted tokens) or add signature validation columns. Happy data wrangling. Have you built a similar converter for a different token format? Let me know in the comments.