josepy
JOSE protocol implementation in Python
Decision gist · record as of 2026-08-14
Yes. Josepy is a stable, actively maintained implementation of a standard protocol with low install friction, no known vulnerabilities, and permissive licensing. Install it if you need JOSE functionality in Python.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.9.2 or later; cryptography library must be installed and functional.
- Low friction install with a single runtime dependency on cryptography.
- Active maintenance with recent commits and stable production status across Python 3.9 through 3.14.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 permissive license allows commercial and private use with minimal restrictions; you must retain license and copyright notices in distributions.
last release 2025-10-14 (304 days) · last repo commit 2026-08-06 · 48 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 2,060,328 downloads/mo, #3,332 on PyPI
Alternatives
Verify before relying
pip install josepy
from josepy import jws, jwk
# Create a JWK and sign a message
key = jwk.RSAKey(...)
message = jws.JWS.sign(b'payload', key=key)- Whether the package supports all JOSE specification features or a subset of the standard
- Performance characteristics for large-scale signing and encryption workloads
- Specific algorithm support beyond what cryptography provides
What it is and what it does
Josepy is a pure-Python implementation of the JOSE (JSON Object Signing and Encryption) standard, built on top of the cryptography library. It handles the serialization, signing, and encryption of JSON objects according to the JOSE specification, making it suitable for applications that need to authenticate or protect JSON-based messages in transit or at rest.
The package is actively maintained and widely used, with stable production status and support for Python 3.9 through 3.14. Its single runtime dependency on cryptography keeps the installation footprint small, and the permissive Apache-2.0 license makes it suitable for both open-source and proprietary projects.
Use it for
- Sign and verify JSON Web Tokens for API authentication and authorization flows
- Encrypt and decrypt sensitive JSON payloads in microservice communication
- Implement ACME protocol clients that require JOSE message signing
- Protect JSON-based configuration or credential data with cryptographic integrity checks
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
Josepy is a stable, actively maintained implementation of a standard protocol with low install friction, no known vulnerabilities, and permissive licensing. Install it if you need JOSE functionality in Python.
Install
josepy on PyPI
Before you install
Low friction install with a single runtime dependency on cryptography. Active maintenance with recent commits and stable production status across Python 3.9 through 3.14.
Requires Python 3.9.2 or later; cryptography library must be installed and functional.
License in practice
Apache-2.0 permissive license allows commercial and private use with minimal restrictions; you must retain license and copyright notices in distributions.
Quickstart
pip install josepy
from josepy import jws, jwk
# Create a JWK and sign a message
key = jwk.RSAKey(...)
message = jws.JWS.sign(b'payload', key=key)Verify before relying
- Whether the package supports all JOSE specification features or a subset of the standard
- Performance characteristics for large-scale signing and encryption workloads
- Specific algorithm support beyond what cryptography provides
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release >=3.9.2 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagecryptography |
| Maintenance | Actively maintained 304 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 2,060,328 / month, #3,332 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: 3.9Topic :: Internet :: WWW/HTTPTopic :: Security |
Evidence: josepy-2.2.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “JOSE protocol implementation”
- josepyImplements the JOSE (JSON Object Signing and Encryption) protocol in…
- AuthlibAuthlib provides a complete implementation of OAuth 1.0, OAuth 2.0,…
- joseImplements JSON Web Signature (JWS) and JSON Web Encryption (JWE) for…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also python-jose · jose · joserfc · signedjson · jwskate · pyjwkest · pyseto · types-python-jose · pymacaroons · Authlib