jpadilla/pyjwt
Pyjwt
PyJWT is a Python library for encoding, decoding, and verifying JSON Web Tokens (JWTs). It provides comprehensive JWT functionality including algorithm-agnostic signing and verification, supporting both symmetric HMAC shared-secret cryptography and asymmetric RSA/ECDSA public-key cryptography for flexible trust models.
The library implements a claim-based validation pipeline that checks issuer, audience, expiration, and other time-based claims during token decoding, with configurable clock skew tolerance for distributed systems. It requires callers to explicitly specify allowed signing algorithms, preventing algorithm confusion attacks, and converts Python dictionaries into compact JSON strings before signing.
PyJWT handles the full token lifecycle, from signing payloads with digital signatures to verifying token authenticity and integrity. It supports encoding tokens with cryptographic signatures and decoding them back into their original payloads while confirming they have not been tampered with.
Features
- JSON Web Tokens - Implements the JSON Web Token standard for creating and validating signed tokens.
- Asymmetric Signing - Provides RSA and ECDSA asymmetric signing for JSON Web Tokens using public-key cryptography.
- Signed JWT Generation - Creates and validates signed JWTs for secure data exchange between parties.
- Python JWT Libraries - Provides a Python library for signing and verifying JSON Web Tokens with symmetric and asymmetric algorithms.
- Symmetric Signing - Verifies token integrity using HMAC digests computed with a shared secret key.
- Dual Symmetric and Asymmetric Support - Supports both HMAC shared-secret and RSA/ECDSA public-key cryptography for flexible trust models.
- Configurable Signing Algorithms - Provides configurable algorithm selection for signing and verifying JSON Web Tokens.
- Algorithm Confusion Prevention - Prevents algorithm confusion attacks by requiring explicit specification of allowed signing algorithms.
- Pluggable Algorithm Dispatch - Dispatches signing and verification to pluggable cryptographic backends selected at encode or decode time.
- JWT Claim Validation - Validates standard JWT claims like expiration, issuer, and audience during token decoding.
- Pluggable Algorithm Dispatch - Dispatches signing and verification to pluggable cryptographic backends selected at encode or decode time.
- Pluggable Cryptographic Backends - Dispatches signing and verification to pluggable cryptographic backends selected at encode or decode time.
- Token Signature Verification - Verifies token signatures using public keys to confirm the signer's identity.
- Token Signing Operations - Signs tokens with private keys to guarantee authenticity and integrity.
- Clock Skew Tolerances - Applies configurable clock skew tolerance to time-sensitive JWT claims for distributed systems.
- Expiration Claim Validators - Checks the expiration claim against the current time during decode, rejecting expired tokens automatically.
- Issuer and Audience Validators - Validates issuer and audience claims against caller-provided values to enforce token scope and origin.
- Authentication - Listed in the “Authentication” section of the Awesome Python awesome list.
- Authentication and Permissions - JSON Web Token implementation in Python.
- Authentication Libraries - Implementation of JSON Web Token standards.
