python-jwt

What it is and what it does

python-jwt is a module for creating and validating JSON Web Tokens, wrapping the cryptographic primitives provided by jwcrypto. It supports multiple signature algorithms including RS256, RS384, RS512, PS256, PS384, PS512, HS256, HS384, HS512, ES256, ES384, ES512, ES256K, and EdDSA. The package provides two main functions: generate_jwt to create signed tokens with a payload and expiration, and verify_jwt to validate a token's signature and extract its claims.

The package is now abandoned; the maintainer has stated they lack time to maintain it. The repository is archived and the last release was in November 2023. While the codebase has been tested for interoperability and includes unit tests, no active development or security updates are expected. Users considering this package should be aware that it will not receive bug fixes or security patches going forward.

Use it for:

• Generate and verify JWTs for stateless authentication in REST APIs or microservices.
• Implement token-based authorization where claims are embedded in the token itself.
• Interoperate with systems that use standard JWT algorithms like RS256 or HS256.
• Export and import cryptographic keys in PEM format for integration with external systems.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates and verifies JSON Web Tokens (JWTs) using a variety of signature algorithms, delegating cryptographic operations to jwcrypto.

No. While the package is functionally complete and has low install friction, it is abandoned and no longer maintained. The maintainer explicitly states they lack time to maintain it, the repository is archived, and no updates have been released since November 2023. For new projects, use an actively maintained JWT library instead. For existing projects already using python-jwt, consider migrating to an alternative that receives security updates and bug fixes.

Install

python-jwt on PyPI

pip install python-jwt

uv add python-jwt

poetry add python-jwt

Installing python-jwt

Before you install

Low install friction with a single runtime dependency. However, the package is abandoned and has not been maintained since November 2023; the repository is archived and the maintainer explicitly states they lack time to maintain it.

License in practice

MIT license is permissive and places no restrictions on use, modification, or distribution in commercial or private projects.

Quickstart

pip install python_jwt

import python_jwt as jwt
import jwcrypto.jwk as jwk
import datetime

key = jwk.JWK.generate(kty='RSA', size=2048)
payload = {'foo': 'bar'}
token = jwt.generate_jwt(payload, key, 'RS256', datetime.timedelta(minutes=5))
header, claims = jwt.verify_jwt(token, key, ['RS256'])

Requires Python 3.6 or later.

Verify before relying

• Whether the abandoned status and lack of maintenance since November 2023 poses a risk for new projects or production use.
• Current status of the CVE-2022-39227 vulnerability fix in version 4.1.0 and whether any newer issues have emerged post-abandonment.

Package facts

Evidence: python_jwt-4.1.0-py2.py3-none-any.whl

Tags

More Cryptography packages