How to Encode and Decode JWT with HS256 in Python

import base64
import hashlib
import hmac
import json


def base64url_encode(data: bytes) -> bytes:
    return base64.urlsafe_b64encode(data).rstrip(b"=")


def base64url_decode(data: str) -> bytes:
    padding = "=" * (-len(data) % 4)
    return base64.urlsafe_b64decode(data + padding)


def encode_jwt(payload: dict, secret: str) -> str:
    header = {"alg": "HS256", "typ": "JWT"}
    header_encoded = base64url_encode(json.dumps(header, separators=(",", ":")).encode())
    payload_encoded = base64url_encode(json.dumps(payload, separators=(",", ":")).encode())
    signing_input = header_encoded + b"." + payload_encoded
    signature = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
    return (signing_input + b"." + base64url_encode(signature)).decode()


def decode_jwt(token: str, secret: str) -> dict:
    header_encoded, payload_encoded, signature_encoded = token.split(".")
    signing_input = (header_encoded + "." + payload_encoded).encode()
    expected_signature = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
    actual_signature = base64url_decode(signature_encoded)
    if not hmac.compare_digest(expected_signature, actual_signature):
        raise ValueError("Invalid signature")
    payload = json.loads(base64url_decode(payload_encoded))
    return payload


if __name__ == "__main__":
    secret = "mysecretkey"
    token = encode_jwt({"user": "alice", "role": "admin"}, secret)
    print("Token:", token)
    print("Decoded:", decode_jwt(token, secret))