---
id: josepy
version: "2.2.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# josepy — JOSE protocol implementation in Python

License: permissive · Maintenance: active · Downloads: 2.1M/mo

## What it is and what it does

Josepy is a pure-Python implementation of the JOSE (JSON Object Signing and Encryption) standard, built on top of the cryptography library. It handles the serialization, signing, and encryption of JSON objects according to the JOSE specification, making it suitable for applications that need to authenticate or protect JSON-based messages in transit or at rest.

The package is actively maintained and widely used, with stable production status and support for Python 3.9 through 3.14. Its single runtime dependency on cryptography keeps the installation footprint small, and the permissive Apache-2.0 license makes it suitable for both open-source and proprietary projects.

Use it for:

- Sign and verify JSON Web Tokens for API authentication and authorization flows
- Encrypt and decrypt sensitive JSON payloads in microservice communication
- Implement ACME protocol clients that require JOSE message signing
- Protect JSON-based configuration or credential data with cryptographic integrity checks

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Implements the JOSE (JSON Object Signing and Encryption) protocol in Python, providing cryptographic signing and encryption for JSON-based message authentication and integrity.

Yes. Josepy is a stable, actively maintained implementation of a standard protocol with low install friction, no known vulnerabilities, and permissive licensing. Install it if you need JOSE functionality in Python.

## Install

pip install josepy
uv add josepy
poetry add josepy

## Installing josepy

Before you install: Low friction install with a single runtime dependency on cryptography. Active maintenance with recent commits and stable production status across Python 3.9 through 3.14.

License in practice: Apache-2.0 permissive license allows commercial and private use with minimal restrictions; you must retain license and copyright notices in distributions.

Quickstart:

pip install josepy

from josepy import jws, jwk

# Create a JWK and sign a message
key = jwk.RSAKey(...)
message = jws.JWS.sign(b'payload', key=key)

Requires Python 3.9.2 or later; cryptography library must be installed and functional.

Verify before relying:

- Whether the package supports all JOSE specification features or a subset of the standard
- Performance characteristics for large-scale signing and encryption workloads
- Specific algorithm support beyond what cryptography provides

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.1M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

JOSE protocol implementation, JSON object signing encryption, cryptographic message authentication, JWS JWE JSON web signature, JOSE JSON serialization, jose python cryptography, jose, cryptography

[View on SkillFed](https://skillfed.io/packages/josepy) · [View on PyPI](https://pypi.org/project/josepy/)