---
id: python-jwt
version: "4.1.0"
license: MIT
license_treatment: permissive
maintenance: abandoned
---

# python-jwt — Module for generating and verifying JSON Web Tokens

License: permissive · Maintenance: abandoned · Downloads: 374.0K/mo

## What it is and what it does

python-jwt is a module for creating and validating JSON Web Tokens, wrapping the cryptographic primitives provided by jwcrypto. It supports multiple signature algorithms including RS256, RS384, RS512, PS256, PS384, PS512, HS256, HS384, HS512, ES256, ES384, ES512, ES256K, and EdDSA. The package provides two main functions: generate_jwt to create signed tokens with a payload and expiration, and verify_jwt to validate a token's signature and extract its claims.

The package is now abandoned; the maintainer has stated they lack time to maintain it. The repository is archived and the last release was in November 2023. While the codebase has been tested for interoperability and includes unit tests, no active development or security updates are expected. Users considering this package should be aware that it will not receive bug fixes or security patches going forward.

Use it for:

- Generate and verify JWTs for stateless authentication in REST APIs or microservices.
- Implement token-based authorization where claims are embedded in the token itself.
- Interoperate with systems that use standard JWT algorithms like RS256 or HS256.
- Export and import cryptographic keys in PEM format for integration with external systems.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates and verifies JSON Web Tokens (JWTs) using a variety of signature algorithms, delegating cryptographic operations to jwcrypto.

No. While the package is functionally complete and has low install friction, it is abandoned and no longer maintained. The maintainer explicitly states they lack time to maintain it, the repository is archived, and no updates have been released since November 2023. For new projects, use an actively maintained JWT library instead. For existing projects already using python-jwt, consider migrating to an alternative that receives security updates and bug fixes.

## Install

pip install python-jwt
uv add python-jwt
poetry add python-jwt

## Installing python-jwt

Before you install: Low install friction with a single runtime dependency. However, the package is abandoned and has not been maintained since November 2023; the repository is archived and the maintainer explicitly states they lack time to maintain it.

License in practice: MIT license is permissive and places no restrictions on use, modification, or distribution in commercial or private projects.

Quickstart:

pip install python_jwt

import python_jwt as jwt
import jwcrypto.jwk as jwk
import datetime

key = jwk.JWK.generate(kty='RSA', size=2048)
payload = {'foo': 'bar'}
token = jwt.generate_jwt(payload, key, 'RS256', datetime.timedelta(minutes=5))
header, claims = jwt.verify_jwt(token, key, ['RS256'])

Requires Python 3.6 or later.

Verify before relying:

- Whether the abandoned status and lack of maintenance since November 2023 poses a risk for new projects or production use.
- Current status of the CVE-2022-39227 vulnerability fix in version 4.1.0 and whether any newer issues have emerged post-abandonment.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: abandoned
- Downloads: 374.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

jwt generation verification, json web token library, jwt signing verification, token authentication, jwt with rsa ecdsa hmac, jwt, authentication, abandoned

[View on SkillFed](https://skillfed.io/packages/python-jwt) · [View on PyPI](https://pypi.org/project/python-jwt/)