jwt

What it is and what it does

python-jwt is a JSON Web Token implementation for Python that handles the full lifecycle of JWT creation and validation. It provides a JWT class for encoding messages into signed tokens and decoding them with signature verification, supporting both symmetric algorithms (HS256, HS384, HS512) and asymmetric algorithms (RS256, RS384, RS512, PS256, PS384, PS512). The library integrates with the cryptography package for key management and can load keys from JWK dictionaries or PEM files.

The package is designed for authentication and authorization workflows where you need to create tamper-proof tokens, verify their signatures, and validate claims like expiration time. It follows the JWT specification and includes utilities for working with datetime objects in token claims. The library is marked Production/Stable and supports Python 3.9 and later versions.

Use it for:

• Build stateless authentication systems where tokens are signed and verified without server-side session storage
• Implement OAuth 2.0 or OpenID Connect flows requiring JWT access and ID tokens
• Create API authentication where clients include signed tokens in request headers
• Validate third-party tokens from external identity providers using their public keys
• Secure inter-service communication in microservices by signing and verifying service-to-service tokens

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Encodes and decodes JSON Web Tokens (JWTs) with signature verification, supporting symmetric and asymmetric algorithms including RS256, HS256, and PS256.

Yes. The package offers a straightforward, production-stable JWT implementation with low install friction and no known vulnerabilities. It covers the core JWT use cases with support for modern algorithms and key formats. The aging maintenance status (last commit 417 days ago) is not a blocker for a stable, mature library, but indicates you should not expect frequent feature additions—suitable if you need reliable JWT handling without expecting active development.

Install

jwt on PyPI

pip install jwt

uv add jwt

poetry add jwt

Installing jwt

Before you install

Low install friction with a single cryptography dependency. The package is marked as Production/Stable and has received a release within the last year, though the last commit was 417 days ago, suggesting the project is in maintenance mode rather than active development.

License in practice

Licensed under Apache License 2.0 (permissive), which allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.

Quickstart

pip install jwt

from jwt import JWT, jwk_from_dict
from datetime import datetime, timedelta, timezone
from jwt.utils import get_int_from_datetime

instance = JWT()
message = {'iss': 'https://example.com/', 'sub': 'user', 'exp': get_int_from_datetime(datetime.now(timezone.utc) + timedelta(hours=1))}
signing_key = jwk_from_dict({'kty': 'oct', 'k': 'secret'})
token = instance.encode(message, signing_key, alg='HS256')

Requires Python 3.9 or later; cryptography library must be installed.

Verify before relying

• Whether the package handles JWT refresh tokens or only access tokens
• Performance characteristics when encoding/decoding high volumes of tokens
• Support for custom claims validation beyond standard time checks

Package facts

Evidence: jwt-1.4.0-py3-none-any.whl

Tags

More Python Modules packages