Generate a JWT manually using only base64-url and hash_hmac — no library required. Demonstrates header/payload/signature concatenation and the exp claim.
Standard base64 uses + and / which break in URLs. Swap them for - and _, drop the = padding, and you get a string you can put in path segments and query parameters safely.
Pair to jwtSign: verify the signature, check the exp claim, and return the decoded payload — or null on any failure. Uses hash_equals for constant-time signature comparison.
The de-facto JWT library for Python. HS256 demo with an exp claim and the standard "verify everything" decode flow. Mind that PyJWT raises specific exceptions you can catch separately.