← Anatomy of a JWT
The signature is just bytes
Learn
The signature segment
The signature itself is just bytes: 32 of them for HS256, because SHA-256 outputs 256 bits.
Your b64url_decode
function works on any segment, but the signature isn't text. Count its bytes with wc -c
and print it as hex (xxd -p or od) rather than sending raw bytes to the terminal.
Your task
Decode the third segment (the signature) with your b64url_decode function. Print how many bytes it is, then print those bytes as one line of hex.