jwt
JSON Web Token library for Python 3.
Decision gist · record as of 2026-08-14
Yes. The package offers a straightforward, production-stable JWT implementation with low install friction and no known vulnerabilities. It covers the core JWT use cases with support for modern algorithms and key formats. The aging maintenance status (last commit 417 days ago) is not a blocker for a stable, mature library, but indicates you should not expect frequent feature additions—suitable if you need reliable JWT handling without expecting active development.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.9 or later; cryptography library must be installed.
- Low install friction with a single cryptography dependency.
- The package is marked as Production/Stable and has received a release within the last year, though the last commit was 417 days ago, suggesting the project is in maintenance mode rather than active development.
License · maintenance · safety
permissive license (permissive) — Licensed under Apache License 2.0 (permissive), which allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.
last release 2025-06-23 (417 days) · last repo commit 2026-01-05 · 159 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 3,781,603 downloads/mo, #2,499 on PyPI
Alternatives
Verify before relying
pip install jwt
from jwt import JWT, jwk_from_dict
from datetime import datetime, timedelta, timezone
from jwt.utils import get_int_from_datetime
instance = JWT()
message = {'iss': 'https://example.com/', 'sub': 'user', 'exp': get_int_from_datetime(datetime.now(timezone.utc) + timedelta(hours=1))}
signing_key = jwk_from_dict({'kty': 'oct', 'k': 'secret'})
token = instance.encode(message, signing_key, alg='HS256')- Whether the package handles JWT refresh tokens or only access tokens
- Performance characteristics when encoding/decoding high volumes of tokens
- Support for custom claims validation beyond standard time checks
What it is and what it does
python-jwt is a JSON Web Token implementation for Python that handles the full lifecycle of JWT creation and validation. It provides a JWT class for encoding messages into signed tokens and decoding them with signature verification, supporting both symmetric algorithms (HS256, HS384, HS512) and asymmetric algorithms (RS256, RS384, RS512, PS256, PS384, PS512). The library integrates with the cryptography package for key management and can load keys from JWK dictionaries or PEM files.
The package is designed for authentication and authorization workflows where you need to create tamper-proof tokens, verify their signatures, and validate claims like expiration time. It follows the JWT specification and includes utilities for working with datetime objects in token claims. The library is marked Production/Stable and supports Python 3.9 and later versions.
Use it for
- Build stateless authentication systems where tokens are signed and verified without server-side session storage
- Implement OAuth 2.0 or OpenID Connect flows requiring JWT access and ID tokens
- Create API authentication where clients include signed tokens in request headers
- Validate third-party tokens from external identity providers using their public keys
- Secure inter-service communication in microservices by signing and verifying service-to-service tokens
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
The package offers a straightforward, production-stable JWT implementation with low install friction and no known vulnerabilities. It covers the core JWT use cases with support for modern algorithms and key formats. The aging maintenance status (last commit 417 days ago) is not a blocker for a stable, mature library, but indicates you should not expect frequent feature additions—suitable if you need reliable JWT handling without expecting active development.
Install
jwt on PyPI
Before you install
Low install friction with a single cryptography dependency. The package is marked as Production/Stable and has received a release within the last year, though the last commit was 417 days ago, suggesting the project is in maintenance mode rather than active development.
Requires Python 3.9 or later; cryptography library must be installed.
License in practice
Licensed under Apache License 2.0 (permissive), which allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.
Quickstart
pip install jwt
from jwt import JWT, jwk_from_dict
from datetime import datetime, timedelta, timezone
from jwt.utils import get_int_from_datetime
instance = JWT()
message = {'iss': 'https://example.com/', 'sub': 'user', 'exp': get_int_from_datetime(datetime.now(timezone.utc) + timedelta(hours=1))}
signing_key = jwk_from_dict({'kty': 'oct', 'k': 'secret'})
token = instance.encode(message, signing_key, alg='HS256')Verify before relying
- Whether the package handles JWT refresh tokens or only access tokens
- Performance characteristics when encoding/decoding high volumes of tokens
- Support for custom claims validation beyond standard time checks
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.9 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagecryptography |
| Maintenance | Aging 417 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 3,781,603 / month, #2,499 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.9Topic :: Internet :: WWW/HTTPTopic :: SecurityTopic :: Software Development :: Libraries :: Python Modules |
Evidence: jwt-1.4.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “JWT encode decode”
- jwtEncodes and decodes JSON Web Tokens (JWTs) with signature…
- PyJWTPyJWT encodes and decodes JSON Web Tokens (JWT) according to RFC…
- joserfcjoserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related…
Give your agent the search over MCP, or paste the wish link into any chat.
More Python Modules packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
PyYAML parses and emits YAML 1.1 data format, enabling serialization and deserialization of configuration files and Python objects to and from human-readable YAML text.
Pydantic validates Python data structures against type hints, coercing and checking input at runtime to ensure it matches a declared schema.
Provides reusable metadata objects for use with PEP-593 `typing.Annotated` to express common constraints like bounds, collection sizes, and predicates on types.
Install it if you use or build libraries that need to express type constraints in a standardized, inspectable way—or if you want to annotate your own types with…
Provides runtime tools to inspect and introspect Python type annotations, enabling programmatic examination of type hints at execution time.
See also python-jwt · python-jose · PyJWT · jwskate · joserfc · pyjwkest · jose · myjwt · standardwebhooks · json-timeseries