python-jose

JOSE implementation in Python

python-jose Permissive license MIT Active ★ 1,757 v3.5.0 released 2025-05-28

Install

python-jose on PyPI

pip

pip install python-jose

uv

uv add python-jose

poetry

poetry add python-jose

Package facts

License	MIT (permissive)
Python support	supports the current Python release (>=3.9)
Install friction	low — pure-Python wheel
Runtime dependencies	3 — ecdsa, rsa, pyasn1
Maintenance	actively maintained — 442 days since the last release
Last repo commit	2026-04-14
First released	2015-04-22
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: python_jose-3.5.0-py2.py3-none-any.whl

Keywords: jose, jws, jwe, jwt, json, web, token, security, signing

Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseNatural Language :: EnglishProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.9Programming Language :: Python :: Implementation :: PyPyTopic :: Utilities

About python-jose

from the package's own PyPI description — quoted content, verbatim

python-jose

A JOSE implementation in Python

Docs are available on ReadTheDocs_.

The JavaScript Object Signing and Encryption (JOSE) technologies - JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), and JSON Web Algorithms (JWA) - collectively can be used to encrypt and/or sign content using a variety of algorithms. While the full set of permutations is extremely large, and might be daunting to some, it is expected that most applications will only use a small set of algorithms to meet their needs.

Installation

$ pip install python-jose[cryptography]

Cryptographic Backends

As of 3.3.0, python-jose implements three different cryptographic backends. The backend must be selected as an extra when installing python-jose. If you do not select a backend, the native-python backend will be installed.

Unless otherwise noted, all backends support all operations.

Due to complexities with setuptools, the native-python backend is always installed, even if you select a different backend on install. We recommend that you remove unnecessary...

Read as markdown · JSON record · Source repository · Homepage · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Implements JOSE (JSON Object Signing and Encryption) standards including JWS, JWE, JWK, and JWA to sign and encrypt JSON-based content using various cryptographic algorithms.

Low friction installation with pure-Python wheels. Actively maintained (last commit 2026-04-14) with stable production status. Three runtime dependencies (ecdsa, rsa, pyasn1) are used by the native-Python backend; the package recommends removing unused dependencies in production if a different cryptographic backend is selected.

MIT license (permissive) allows commercial and private use with minimal restrictions, requiring only attribution and inclusion of the license notice.

Usage

pip install python-jose

from python_jose import jwt
token = jwt.encode({'key': 'value'}, 'secret', algorithm='HS256')
decoded = jwt.decode(token, 'secret', algorithms=['HS256'])

Requires Python 3.9 or later. The native-Python backend cannot process certificates.

Verdict: Production-ready JOSE library with active maintenance, no known vulnerabilities, and permissive licensing. Low install friction and broad algorithm support make it suitable for JWT and encryption workflows. Choose your cryptographic backend at install time based on performance and feature needs.

Needs verification

Whether the three runtime dependencies (ecdsa, rsa, pyasn1) are actually needed when using alternative cryptographic backends, and if they can be safely removed post-install
Performance characteristics and security audit status of each cryptographic backend option

JWT token signing and verificationJSON Web Signature JWSJSON Web Encryption JWEJOSE implementation Pythoncryptographic token libraryJWT encode decodeJSON Web Key JWK