Open-source alternatives to Ruby Jwt

This is a Java library for creating and verifying JSON Web Tokens (JWTs), supporting multiple cryptographic signing algorithms including HMAC, RSA, and ECDSA. The library provides a builder pattern for constructing tokens with custom claims and algorithm selection, and offers separate verification methods that check signatures and validate standard claims such as expiration, issuer, and audience. The library abstracts cryptographic algorithms behind a common interface, allowing pluggable signing and verification without coupling token creation to a specific algorithm. Tokens are represented a

express-jwt is a middleware for Express applications that validates JSON Web Tokens to secure routes and authenticate requests. It functions as a security guard that verifies token signatures and expiration dates before allowing access to backend endpoints. The project provides a request credential extractor to retrieve tokens from headers, cookies, or query parameters. It supports dynamic key retrieval to fetch the necessary secrets or public keys at runtime based on request attributes or token headers. The middleware handles JSON Web Token validation, including token expiration handling an

Hanko is an open-source identity provider and customer identity and access management system. It serves as a passkey authentication service and an OAuth and SAML SSO gateway, allowing applications to authenticate users and issue tokens via standard identity protocols. The project distinguishes itself through a strong focus on passwordless access using WebAuthn-based passkeys and email-based passcodes. It provides framework-agnostic authentication interfaces as customizable web components that can be embedded directly into web applications to handle login, registration, and profile management.

Authlib is a comprehensive Python framework for implementing OAuth 1.0, OAuth 2.0, and OpenID Connect clients and servers. It provides a complete toolkit for identity management, spanning the development of authorization servers, resource servers, and client-side integrations. The library distinguishes itself through a full implementation of the JOSE specifications, including JSON Web Tokens, Encryption, Signatures, and Keys. It features specialized capabilities for non-interactive authentication via service account assertion frameworks and a compliance-correction layer designed to handle ide

This project is a JSON Web Token implementation library and toolkit for encoding, signing, and validating tokens. It provides the necessary functions to manage token claims and payloads for user authentication and authorization. The library supports both symmetric and asymmetric cryptography, allowing for the use of shared secrets or public-private key pairs. It enables the creation of signed tokens and the verification of their authenticity and integrity to prevent data tampering. The toolkit covers a broad range of identity and access control capabilities, including the embedding of custom

FastMCP is a Python framework designed for building servers that expose functions, resources, and prompts to AI models using the Model Context Protocol. It simplifies the development process by automatically deriving tool metadata, input schemas, and documentation directly from Python function signatures and type hints. The framework provides a unified container for managing these components, allowing developers to build modular applications that integrate seamlessly with AI assistants. The project distinguishes itself through its support for interactive, server-defined user interface compone

PyJWT is a Python library for encoding, decoding, and verifying JSON Web Tokens (JWTs). It provides comprehensive JWT functionality including algorithm-agnostic signing and verification, supporting both symmetric HMAC shared-secret cryptography and asymmetric RSA/ECDSA public-key cryptography for flexible trust models. The library implements a claim-based validation pipeline that checks issuer, audience, expiration, and other time-based claims during token decoding, with configurable clock skew tolerance for distributed systems. It requires callers to explicitly specify allowed signing algori

This project is a command-line tool for managing public key infrastructure and digital identities. It provides a comprehensive suite for X.509 certificate lifecycle management, including the generation, signing, renewal, and revocation of certificates and signing requests. The tool distinguishes itself through specialized security capabilities such as binding cryptographic credentials to TPMs and HSMs for hardware-backed identity attestation. It also provides dedicated support for machine identity security, using short-lived SSH certificates and mTLS to secure non-human workloads. Broad capa

Higress is an AI API gateway and cloud-native traffic manager that functions as a Kubernetes ingress controller. It provides a centralized system for routing, securing, and optimizing traffic directed toward large language models, AI agents, and microservice architectures. The project distinguishes itself through deep AI orchestration, including the ability to host and manage Model Context Protocol servers that transform REST APIs into tools for AI agents. It features specialized AI infrastructure for model request proxying, protocol translation across multiple providers, and semantic-based c

Vapor is a comprehensive server-side web framework designed for building scalable, high-performance applications and APIs in Swift. It provides a non-blocking, event-loop-based runtime that manages concurrent task processing, background job queues, and asynchronous request handling. The framework is built around a dependency injection container that manages the lifecycle and resolution of services, configurations, and database connections throughout the request pipeline. The framework distinguishes itself through a protocol-oriented design that emphasizes type safety across all layers of the

Quarkus is a Kubernetes-native Java framework designed for building high-performance, memory-efficient applications. It utilizes ahead-of-time native compilation to transform Java code into standalone, optimized binaries that eliminate the need for a virtual machine, enabling rapid startup and reduced memory consumption. By performing code augmentation during the build phase, it shifts heavy processing tasks away from runtime, ensuring that applications are optimized for cloud-native environments. The framework distinguishes itself through a unified approach to reactive and imperative program

This project is a technical tutorial and guide for implementing user identity and session management using JSON Web Tokens. It focuses on building a secure login system that verifies user identities in web and mobile applications. The material covers the full lifecycle of token-based security, including the issuance and validation of authentication tokens and the management of stateless sessions. It provides instructions on maintaining persistent user sessions through client-side storage and implementing session revocation to invalidate specific or all active tokens. The implementation detai

Osmedeus is a security workflow orchestration engine that coordinates AI agents, shell commands, and scanning tools through declarative YAML pipelines. It functions as a distributed security scanner, a declarative workflow automator, and an AI agent framework for security, enabling automated multi-step security analysis with conditional branching, parallel execution, and distributed workers. The engine distinguishes itself through a hybrid runner model that executes workflow steps on the local host, inside Docker containers, or over SSH to remote machines, selected per step or module. It supp

LoopBack Next is a Node.js API framework used for building REST and multi-protocol APIs. It functions as an OpenAPI server implementation that can either generate machine-readable specifications from code or produce implementation controllers and models from existing specifications. The framework distinguishes itself through a central dependency injection container and a repository-pattern data access layer. This architecture decouples application logic from component construction and persistent storage, allowing for a pluggable system where data sources and business logic are isolated throug

jwt_tool is a security testing toolkit designed for analyzing, tampering with, and auditing JSON Web Tokens to identify cryptographic vulnerabilities and implementation flaws. It serves as a comprehensive suite for security auditing and vulnerability scanning, providing a debugging interface to inspect token headers and payloads. The project distinguishes itself through specialized capabilities for token forgery and secret cracking. It includes a token generator that signs custom tokens using RSA, ECDSA, and symmetric algorithms, and a brute force tool that uses high-speed dictionary attacks

This project is a web application security standard and vulnerability framework. It provides a comprehensive list of the most critical security risks facing web applications, paired with technical guidance and a structured methodology for identifying and mitigating these flaws. The framework functions as a secure coding guide and a risk assessment methodology, offering a standardized approach to prioritizing vulnerabilities based on their potential impact and likelihood of exploitation. It defines architectural patterns and technical recommendations to help developers implement defense in dep

Synapse is a Matrix homeserver implementation that provides the infrastructure for decentralized, real-time communication and messaging. It functions as a federated chat server that synchronizes room data and event streams across independent server instances to enable cross-domain interoperability. The server utilizes a hybrid core that integrates performance-critical logic in Rust with a Python orchestration layer. It employs a PostgreSQL relational database for persisting user accounts and conversation history, and uses a Redis-based messaging system to distribute tasks across horizontal wo

This project is a .NET identity stack and server framework used to build certified OpenID Connect and OAuth 2.0 identity providers. It provides the core logic required to issue and validate security tokens and manage user authentication across various grant types and protocol flows. The framework includes a protocol translation layer that bridges OpenID Connect and SAML to enable interoperability between different identity providers. It also supports a stateless mode of operation, which removes built-in validation and storage to allow for manual control over token and client verification. Th

Pomerium is an identity-aware reverse proxy designed to provide zero-trust access control for internal infrastructure. It functions as a centralized gateway that verifies user identity, device context, and group membership for every request before granting access to protected applications, services, or API servers. By integrating directly with external identity providers, it replaces traditional VPNs with granular, policy-based access enforcement. The platform distinguishes itself by extending zero-trust principles beyond standard web traffic to include non-HTTP protocols, such as TCP and UDP

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

Doorkeeper is an OAuth 2 authorization server and provider for Ruby on Rails and Grape applications. It provides the necessary framework to build an authorization server that issues and validates security tokens for third-party applications, effectively acting as a security middleware to protect API endpoints. The project integrates an identity layer via OpenID Connect to verify user identities and retrieve profile information. It supports a variety of security patterns, including the implementation of the PKCE flow for public clients and the issuance of stateless JSON Web Tokens. Its broade

Authlogic is a Ruby authentication framework designed to manage user identities, session persistence, and secure password hashing. It provides a system for verifying user credentials against stored records using configurable identity fields. The framework distinguishes itself through its provider-based identity integration, allowing applications to connect authentication flows to external services including OAuth, OpenID Connect, LDAP, and various social media platforms. It also includes an extensibility model that executes custom user-defined code via hooks and callbacks during identity veri

Elsa Core is a workflow engine framework designed for defining, executing, and managing long-running business processes. It functions as a distributed workflow orchestrator and event-driven trigger system, capable of operating as a multi-tenant platform with secure data isolation. The project distinguishes itself through a flexible approach to workflow definitions, supporting a visual drag-and-drop designer, programmatic C# definitions, and portable JSON specifications. It provides a highly extensible architecture allowing for the development of custom activities and the use of a dynamic expr

This project is a public key infrastructure management system designed to automate the issuance, renewal, and revocation of X.509, TLS, and SSH certificates. It functions as a machine identity provider and certificate authority, enabling the establishment of private PKI to secure inter-service communication and remote access. The system distinguishes itself through hardware-bound identity attestation, which ties cryptographic keys to physical device silicon or TPMs to prevent credential exfiltration. It supports a wide array of identity verification mechanisms, including OIDC, cloud-provider

OpenViking is a multi-tenant context server and knowledge base administration system designed to provide AI agents with persistent long-term memory. It enables the indexing of diverse documents and codebases to support retrieval-augmented generation, allowing agents to recall past interactions, user preferences, and learned experiences across sessions. The project is distinguished by its use of a URI-based virtual filesystem to organize memories, resources, and skills. It implements a tiered context loading system that balances retrieval precision with token budgets by structuring data into a

Redis is a high-performance in-memory key-value store that functions as a distributed cache, message broker, and NoSQL database. It provides sub-millisecond read and write access to data stored in RAM and can operate as a vector database for indexing high-dimensional embeddings. The system supports a wide range of data storage and synchronization primitives, including the management of strings, hashes, lists, sets, and JSON documents. It enables real-time data operations through atomic transactions, hybrid persistence using snapshots and append-only logs, and high-availability configurations

GoTrue is a JWT identity provider and user management API. It functions as an OAuth 2.0 compliant server that handles user registration and authentication while issuing signed JSON Web Tokens to control access to protected API resources. The service integrates external identity providers to allow users to sign in using third-party accounts. It also includes an SMTP notification service for delivering password resets, signup confirmations, and account recovery emails. The system covers broader capabilities for user account management, including the ability to update user profiles and manage c