jose

What it is and what it does

jose is a Python implementation of the JOSE (JSON Object Signing and Encryption) framework, providing tools to create and verify JWTs for secure claim transfer between parties. It supports both JWS (signed, readable tokens) and JWE (encrypted, opaque tokens) formats, along with a subset of JOSE-recommended cryptographic algorithms for authentication and authorization.

The package is dormant: its last release was in 2015-11-13, it targets Python 2 only, and it has not received active maintenance for nearly a decade. While the repository is not archived and a final commit exists from 2024-05-30, the codebase reflects its age and pre-dates modern Python versions, modern cryptographic best practices, and current JWT standards evolution. It carries no known vulnerabilities in the OSV database as of the query date, but its unmaintained status means security issues may not be discovered or patched.

Use it for:

• Verify or decrypt JWTs created by older jose-based systems that predate current JWT libraries.
• Maintain legacy Python 2 codebases that already depend on jose and cannot migrate to modern alternatives.
• Prototype JOSE framework concepts in educational settings where the age of the implementation is not a concern.
• Integrate with existing systems where jose is a hard dependency and replacement is not feasible.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Implements JSON Web Signature (JWS) and JSON Web Encryption (JWE) for securely creating and verifying JSON Web Tokens (JWTs) that carry claims for authorization and authentication.

No. The package is unmaintained (last release 2015-11-13), targets Python 2 only, and has not received security updates in nearly a decade. For any new project, use an actively maintained JWT library. Only install if you are maintaining legacy Python 2 code that already depends on it and cannot migrate.

Install

jose on PyPI

pip install jose

uv add jose

poetry add jose

Installing jose

Before you install

High install friction: the package is dormant (last release 2015-11-13, last commit 2024-05-30), targets Python 2 only, and has not received maintenance for nearly a decade. Installation may require working around deprecated dependencies.

License in practice

Licensed under BSD (permissive), so commercial and private use are permitted without restriction, but you assume all liability for security issues in unmaintained code.

Quickstart

pip install jose==1.0.0

from jose import jwt

token = jwt.encode({'claims': 'data'}, 'secret-key')
verified = jwt.decode(token, 'secret-key')

Python 2 only; modern Python 3 environments may not be compatible. Requires pycrypto or a compatible successor; installation may fail on systems without legacy crypto libraries.

Verify before relying

• Whether the package's cryptographic implementations remain secure against modern attack vectors given its age and lack of maintenance.
• Whether runtime dependencies are still installable and compatible with current Python versions despite Python 2-only classifier.
• Whether the backwards-incompatible changes in v1.0.0 and v0.3.0 affect your existing token ecosystem.
• What specific algorithms are supported beyond the subset mentioned in the description.

Package facts

Evidence: jose-1.0.0.tar.gz

Tags

More Libraries packages