josepy

JOSE protocol implementation in Python

josepy v2.2.0 2.1M downloads/30d#3,332 on PyPI★ 48

Permissive license Apache-2.0 Active released 2025-10-14

What it is and what it does

Josepy is a pure-Python implementation of the JOSE (JSON Object Signing and Encryption) standard, built on top of the cryptography library. It handles the serialization, signing, and encryption of JSON objects according to the JOSE specification, making it suitable for applications that need to authenticate or protect JSON-based messages in transit or at rest.

The package is actively maintained and widely used, with stable production status and support for Python 3.9 through 3.14. Its single runtime dependency on cryptography keeps the installation footprint small, and the permissive Apache-2.0 license makes it suitable for both open-source and proprietary projects.

Use it for:

Sign and verify JSON Web Tokens for API authentication and authorization flows
Encrypt and decrypt sensitive JSON payloads in microservice communication
Implement ACME protocol clients that require JOSE message signing
Protect JSON-based configuration or credential data with cryptographic integrity checks

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Implements the JOSE (JSON Object Signing and Encryption) protocol in Python, providing cryptographic signing and encryption for JSON-based message authentication and integrity.

Yes. Josepy is a stable, actively maintained implementation of a standard protocol with low install friction, no known vulnerabilities, and permissive licensing. Install it if you need JOSE functionality in Python.

Install

josepy on PyPI

pip

pip install josepy

uv

uv add josepy

poetry

poetry add josepy

Installing josepy

Before you install

Low friction install with a single runtime dependency on cryptography. Active maintenance with recent commits and stable production status across Python 3.9 through 3.14.

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions; you must retain license and copyright notices in distributions.

Quickstart

pip install josepy

from josepy import jws, jwk

# Create a JWK and sign a message
key = jwk.RSAKey(...)
message = jws.JWS.sign(b'payload', key=key)

Requires Python 3.9.2 or later; cryptography library must be installed and functional.

Verify before relying

Whether the package supports all JOSE specification features or a subset of the standard
Performance characteristics for large-scale signing and encryption workloads
Specific algorithm support beyond what cryptography provides

Package facts

License	Apache-2.0 (permissive)
Python support	supports the current Python release (>=3.9.2)
Install friction	low — pure-Python wheel
Runtime dependencies	1 — cryptography
Maintenance	actively maintained — 304 days since the last release
Last repo commit	2026-08-06
First released	2017-10-13
Downloads	2,060,328/month — #3,332 on PyPI (30-day window, as of 2026-08-14)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-14)

Evidence: josepy-2.2.0-py3-none-any.whl

Development Status :: 5 - Production/StableIntended Audience :: DevelopersProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: 3.9Topic :: Internet :: WWW/HTTPTopic :: Security