Clasp
Fast, type-safe JWT/JWKS verification for Python — written in Rust.
Why
Most JWT libraries treat algorithm choice as a runtime string comparison,
which is exactly the class of bug behind real, disclosed CVEs — algorithm
confusion (an RSA public key misused as an HMAC secret), and alg=none
bypasses missed by case-sensitive checks. Clasp makes that class of bug
impossible by construction: symmetric and asymmetric keys are distinct
Rust types, so mixing them is a compile error, not a runtime footgun.
Performance
All numbers below are real, measured, single-threaded benchmarks against
the same signed token, not vendor-cited figures — every one of them is
reproducible from a committed script, see benchmarks/.
| Comparison | Result |
|---|---|
vs. properly-configured PyJWT (cryptography backend), HS256 decode() |
5.53x faster |
vs. python-jose's default pure-Python backend (a common unintentional misconfiguration — see below), RS256 |
16.0x faster |
vs. python-jose's default pure-Python backend, ES256 |
42.6x faster |
| JWKS cache-hit, vs. PyJWT with the key cached in-process (zero I/O, apples-to-apples) | 1.45x faster |
| JWKS cache-hit, vs. PyJWT re-fetching the key from Redis on every call | 5.22x faster |
Properly-configured PyJWT is already fast — its crypto math is
C-accelerated — so Clasp doesn't chase an inflated speedup claim there;
5.53x is the honest, real gap once Python-side JOSE parsing and cache
overhead are removed from around an already-fast crypto call.
python-jose, by contrast, defaults to a pure-Python RSA/ECDSA
backend unless explicitly reconfigured with the cryptography extra —
a misconfiguration many projects run on unknowingly, where a native
implementation is a large, legitimate win.
Status
Implemented and tested: HMAC (HS256/384/512), RSA (RS256/384/512, PS256/384/512), EC (ES256/384), and Ed25519 verification, plus JWKS fetch/cache with key rotation. Pre-1.0 / alpha — API may still change. Not yet implemented: OAuth2 token introspection (RFC 7662; a different mechanism from JWT self-verification, deliberately out of scope for now).
License
Dual-licensed under MIT or Apache-2.0, at your option.
1 maintainer
Metadata
1 maintainer
Release files for clasp-jwt 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| clasp_jwt-0.1.0.tar.gz | 34.1 kB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| clasp_jwt-0.1.0-cp38-abi3-win_amd64.whl | CPython 3.8 | abi3 | Windows x86-64 | Details |
| clasp_jwt-0.1.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl | CPython 3.8 | abi3 | Linux glibc 2.17+ x86-64 | Details |
| clasp_jwt-0.1.0-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl | CPython 3.8 | abi3 | Linux glibc 2.17+ ARM64 | Details |
| clasp_jwt-0.1.0-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl | CPython 3.8 | abi3 | macOS 11.0+ ARM64, macOS 10.12+ universal2 (ARM64, x86-64), macOS 10.12+ x86-64 | Details |
Total release size: 6.7 MB
Release files / clasp_jwt-0.1.0.tar.gz
| Download URL | clasp_jwt-0.1.0.tar.gz |
|---|---|
| Size | 34.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e5f3b4030a65c7806288b29299235735fce982de7b14f86529281a7d8e348197
|
|
BLAKE2b-256 checksum How to use checksums |
58b822a25921ccc75b44ab5ffb08d653939af7bb18d2b95377273c1db2b08caf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
maturin/1.14.1
|
Release files / clasp_jwt-0.1.0-cp38-abi3-win_amd64.whl
| Download URL | clasp_jwt-0.1.0-cp38-abi3-win_amd64.whl |
|---|---|
| Size | 1.2 MB |
| Tags | CPython 3.8 Windows x86-64 abi3 |
|
SHA-256 checksum How to use checksums |
483a3e39be48e903b30f6999ebbdbaf91d6cc95ca8520e0c8b0d45711910e798
|
|
BLAKE2b-256 checksum How to use checksums |
a786eace01ae681c1215cfbfc610e8d7965eb8fcf72b220fd1df1eb1385be6c8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
maturin/1.14.1
|
Release files / clasp_jwt-0.1.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
| Download URL | clasp_jwt-0.1.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
|---|---|
| Size | 1.4 MB |
| Tags | CPython 3.8 Linux glibc 2.17+ x86-64 abi3 |
|
SHA-256 checksum How to use checksums |
1c9bf227f86b1af270e8cdf6580790010e61a1ef423cfdaaaaac03818d1aa4c6
|
|
BLAKE2b-256 checksum How to use checksums |
2a69ae01cc94b741bc372091c3c2d3c8af9c72303d147a26bdd4904371c4a838
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
maturin/1.14.1
|
Release files / clasp_jwt-0.1.0-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
| Download URL | clasp_jwt-0.1.0-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl |
|---|---|
| Size | 1.4 MB |
| Tags | CPython 3.8 Linux glibc 2.17+ ARM64 abi3 |
|
SHA-256 checksum How to use checksums |
865f8d4a4da8afd382750e9798635f3c70c15e7f1bb8a120d88945912f528cb1
|
|
BLAKE2b-256 checksum How to use checksums |
8d3749c6474bf5636c5f70575f7094b5e4ff06f8859d3435ddbab83d7cea68e2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
maturin/1.14.1
|
Release files / clasp_jwt-0.1.0-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl
| Download URL | clasp_jwt-0.1.0-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl |
|---|---|
| Size | 2.6 MB |
| Tags | CPython 3.8 abi3 macOS 10.12+ universal2 (ARM64, x86-64) macOS 10.12+ x86-64 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
164d98bf9ebf1638f5de1320eca1076dd7b2a8b96d0769012d1b721ae5c8fa19
|
|
BLAKE2b-256 checksum How to use checksums |
d52156739d28f21806cef9c4d5ca59713d747e4c6ac412e9a28122e744b8676e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
maturin/1.14.1
|
