Python下无密钥解析JWT Token报错问题及可行性咨询

我在Python 3.10环境（pyjwt版本为2.8.0）中使用以下代码解析JWT Token：

import jwt

if __name__ == '__main__':
    access_token = "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiSW5kaXZpZHVhbCIsInVzZXJJZCI6Ikp5UHZaczhTVUVwYkZXQkpsLzRwK2RBclRhRE5Tc28wVzZaVTVXN2k1L1E9IiwiZW1haWwiOiJGU3A2SmNvakRsd2xnVnZDa2YzOUxKVDN0bVhRRVF3TGdwSXRTSVkzNitwVmJyRlR5L0xzYkM2NFZnTVQzdkVXMDBZNzBkSjIvQlJ1TC9SL05QQWt5UT09IiwibmJmIjoxNjk5NDI5ODg4LCJleHAiOjE2OTk0MzU4ODgsImlhdCI6MTY5OTQyOTg4OH0.ujpKdHcdN2R2-6Bw9aR1d0RjCDuJLMUogge4FGb0F01oMKpeP4EM4FVbOuOZj0KwtSOl2gsb5yoBt0ooqXz8GA"
    parsed_token = jwt.decode(jwt=access_token, key='', verify=False, algorithms=['HS512'])
    exp = parsed_token["exp"]

执行后出现如下错误：

Traceback (most recent call last):
  File "/Users/dolphin/Applications/PyCharm Community.app/Contents/plugins/python-ce/helpers/pydev/pydevd.py", line 1500, in _exec
    pydev_imports.execfile(file, globals, locals)  # execute the script
  File "/Users/dolphin/Applications/PyCharm Community.app/Contents/plugins/python-ce/helpers/pydev/_pydev_imps/_pydev_execfile.py", line 18, in execfile
    exec(compile(contents+"\n", file, 'exec'), glob, loc)
  File "/Users/dolphin/source/visa/test/test_jwt_parse.py", line 5, in <module>
    parsed_token = jwt.decode(jwt=access_token, key='', verify=False, algorithms=['HS512'])
  File "/Users/dolphin/source/visa/venv/lib/python3.10/site-packages/jwt/api_jwt.py", line 210, in decode
    decoded = self.decode_complete(
  File "/Users/dolphin/source/visa/venv/lib/python3.10/site-packages/jwt/api_jwt.py", line 151, in decode_complete
    decoded = api_jws.decode_complete(
  File "/Users/dolphin/source/visa/venv/lib/python3.10/site-packages/jwt/api_jws.py", line 209, in decode_complete
    self._verify_signature(signing_input, header, signature, key, algorithms)
  File "/Users/dolphin/source/visa/venv/lib/python3.10/site-packages/jwt/api_jws.py", line 310, in _verify_signature
    raise InvalidSignatureError("Signature verification failed")
jwt.exceptions.InvalidSignatureError: Signature verification failed
python-BaseException

已设置verify=False，但仍无法解析JWT Token，请问该如何解决？是否可以无需签名或密钥解析Token？查阅pyjwt官方文档示例，未找到无密钥解析的相关演示。

问题原因 #

PyJWT 2.x版本中，即便设置了verify=False，如果指定了algorithms参数，库仍会触发签名验证逻辑；同时传入空字符串作为key也会导致验证失败。

解决方法 #

可以通过两种方式实现无密钥解析JWT（仅解码Payload部分）：

方法1：手动拆分JWT解码

JWT由Header、Payload、Signature三部分用.分隔，直接拆分出Payload部分做Base64URL解码即可：

import base64
import json

def decode_jwt_without_key(token):
    parts = token.split('.')
    if len(parts) != 3:
        raise ValueError("无效的JWT Token")
    
    # 处理Base64URL编码的补位问题
    payload_part = parts[1]
    payload_part += '=' * (-len(payload_part) % 4)
    
    # 解码并转为JSON格式
    payload_bytes = base64.urlsafe_b64decode(payload_part)
    return json.loads(payload_bytes)

if __name__ == '__main__':
    access_token = "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiSW5kaXZpZHVhbCIsInVzZXJJZCI6Ikp5UHZaczhTVUVwYkZXQkpsLzRwK2RBclRhRE5Tc28wVzZaVTVXN2k1L1E9IiwiZW1haWwiOiJGU3A2SmNvakRsd2xnVnZDa2YzOUxKVDN0bVhRRVF3TGdwSXRTSVkzNitwVmJyRlR5L0xzYkM2NFZnTVQzdkVXMDBZNzBkSjIvQlJ1TC9SL05QQWt5UT09IiwibmJmIjoxNjk5NDI5ODg4LCJleHAiOjE2OTk0MzU4ODgsImlhdCI6MTY5OTQyOTg4OH0.ujpKdHcdN2R2-6Bw9aR1d0RjCDuJLMUogge4FGb0F01oMKpeP4EM4FVbOuOZj0KwtSOl2gsb5yoBt0ooqXz8GA"
    parsed_token = decode_jwt_without_key(access_token)
    exp = parsed_token["exp"]
    print(exp)

方法2：调整PyJWT解码参数

删除algorithms参数，同时通过options明确关闭签名验证：

import jwt

if __name__ == '__main__':
    access_token = "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiSW5kaXZpZHVhbCIsInVzZXJJZCI6Ikp5UHZaczhTVUVwYkZXQkpsLzRwK2RBclRhRE5Tc28wVzZaVTVXN2k1L1E9IiwiZW1haWwiOiJGU3A2SmNvakRsd2xnVnZDa2YzOUxKVDN0bVhRRVF3TGdwSXRTSVkzNitwVmJyRlR5L0xzYkM2NFZnTVQzdkVXMDBZNzBkSjIvQlJ1TC9SL05QQWt5UT09IiwibmJmIjoxNjk5NDI5ODg4LCJleHAiOjE2OTk0MzU4ODgsImlhdCI6MTY5OTQyOTg4OH0.ujpKdHcdN2R2-6Bw9aR1d0RjCDuJLMUogge4FGb0F01oMKpeP4EM4FVbOuOZj0KwtSOl2gsb5yoBt0ooqXz8GA"
    parsed_token = jwt.decode(jwt=access_token, key='', verify=False, options={"verify_signature": False})
    exp = parsed_token["exp"]
    print(exp)

注：部分PyJWT版本可能仍存在兼容性问题，手动解码方式更可靠。

说明 #

无密钥解析仅能获取Payload数据，无法验证数据的真实性和完整性，仅适用于调试、内部可信环境等不需要签名验证的场景。

内容的提问来源于stack exchange，提问作者Dolphin