---
id: jwt
version: "1.4.0"
license: unclear
license_treatment: permissive
maintenance: aging
---

# jwt — JSON Web Token library for Python 3.

License: permissive · Maintenance: aging · Downloads: 3.8M/mo

## What it is and what it does

python-jwt is a JSON Web Token implementation for Python that handles the full lifecycle of JWT creation and validation. It provides a JWT class for encoding messages into signed tokens and decoding them with signature verification, supporting both symmetric algorithms (HS256, HS384, HS512) and asymmetric algorithms (RS256, RS384, RS512, PS256, PS384, PS512). The library integrates with the cryptography package for key management and can load keys from JWK dictionaries or PEM files.

The package is designed for authentication and authorization workflows where you need to create tamper-proof tokens, verify their signatures, and validate claims like expiration time. It follows the JWT specification and includes utilities for working with datetime objects in token claims. The library is marked Production/Stable and supports Python 3.9 and later versions.

Use it for:

- Build stateless authentication systems where tokens are signed and verified without server-side session storage
- Implement OAuth 2.0 or OpenID Connect flows requiring JWT access and ID tokens
- Create API authentication where clients include signed tokens in request headers
- Validate third-party tokens from external identity providers using their public keys
- Secure inter-service communication in microservices by signing and verifying service-to-service tokens

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Encodes and decodes JSON Web Tokens (JWTs) with signature verification, supporting symmetric and asymmetric algorithms including RS256, HS256, and PS256.

Yes. The package offers a straightforward, production-stable JWT implementation with low install friction and no known vulnerabilities. It covers the core JWT use cases with support for modern algorithms and key formats. The aging maintenance status (last commit 417 days ago) is not a blocker for a stable, mature library, but indicates you should not expect frequent feature additions—suitable if you need reliable JWT handling without expecting active development.

## Install

pip install jwt
uv add jwt
poetry add jwt

## Installing jwt

Before you install: Low install friction with a single cryptography dependency. The package is marked as Production/Stable and has received a release within the last year, though the last commit was 417 days ago, suggesting the project is in maintenance mode rather than active development.

License in practice: Licensed under Apache License 2.0 (permissive), which allows commercial use, modification, and distribution with minimal restrictions—suitable for most projects.

Quickstart:

pip install jwt

from jwt import JWT, jwk_from_dict
from datetime import datetime, timedelta, timezone
from jwt.utils import get_int_from_datetime

instance = JWT()
message = {'iss': 'https://example.com/', 'sub': 'user', 'exp': get_int_from_datetime(datetime.now(timezone.utc) + timedelta(hours=1))}
signing_key = jwk_from_dict({'kty': 'oct', 'k': 'secret'})
token = instance.encode(message, signing_key, alg='HS256')

Requires Python 3.9 or later; cryptography library must be installed.

Verify before relying:

- Whether the package handles JWT refresh tokens or only access tokens
- Performance characteristics when encoding/decoding high volumes of tokens
- Support for custom claims validation beyond standard time checks

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 3.8M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

JWT encode decode, JSON web token library, JWT signature verification, RS256 HS256 signing, token authentication, JWS implementation, cryptographic token handling, authentication, cryptography, token-signing

[View on SkillFed](https://skillfed.io/packages/jwt) · [View on PyPI](https://pypi.org/project/jwt/)