python-jwt 
Module for generating and verifying JSON Web Tokens.
All versions of python-jwt are now DEPRECATED. I don't have the time to maintain this module.
- Note: Versions 3.3.4 and later fix a vulnerability (CVE-2022-39227) in JSON Web Token verification which lets an attacker with a valid token re-use its signature with modified claims. CVE to follow. Please upgrade!
- Note: From version 2.0.1 the namespace has changed from
jwttopython_jwt, in order to avoid conflict with PyJWT. - Note: Versions 1.0.0 and later fix a vulnerability in JSON Web Token verification so please upgrade if you're using this functionality. The API has changed so you will need to update your application. verify_jwt now requires you to specify which signature algorithms are allowed.
- Uses jwcrypto to do the heavy lifting.
- Supports RS256, RS384, RS512, PS256, PS384, PS512, HS256, HS384, HS512, ES256, ES384, ES512, ES256K, EdDSA and none signature algorithms.
- Unit tests, including tests for interoperability with jose.
- Supports Python 3.6+. Note: generate_jwt returns the token as a Unicode string.
Example:
import python_jwt as jwt, jwcrypto.jwk as jwk, datetime
key = jwk.JWK.generate(kty='RSA', size=2048)
payload = { 'foo': 'bar', 'wup': 90 };
token = jwt.generate_jwt(payload, key, 'PS256', datetime.timedelta(minutes=5))
header, claims = jwt.verify_jwt(token, key, ['PS256'])
for k in payload: assert claims[k] == payload[k]
The API is described here.
Installation
pip install python_jwt
Another Example
You can read and write keys from and to PEM-format strings:
import python_jwt as jwt, jwcrypto.jwk as jwk, datetime
key = jwk.JWK.generate(kty='RSA', size=2048)
priv_pem = key.export_to_pem(private_key=True, password=None)
pub_pem = key.export_to_pem()
payload = { 'foo': 'bar', 'wup': 90 };
priv_key = jwk.JWK.from_pem(priv_pem)
pub_key = jwk.JWK.from_pem(pub_pem)
token = jwt.generate_jwt(payload, priv_key, 'RS256', datetime.timedelta(minutes=5))
header, claims = jwt.verify_jwt(token, pub_key, ['RS256'])
for k in payload: assert claims[k] == payload[k]
Licence
Tests
make test
Lint
make lint
Code Coverage
make coverage
coverage.py results are available here.
Coveralls page is here.
Benchmarks
make bench
Here are some results on a laptop with an Intel Core i5-4300M 2.6Ghz CPU and 8Gb RAM running Ubuntu 17.04.
| Generate Key | user (ns) | sys (ns) | real (ns) |
|---|---|---|---|
| RSA | 103,100,000 | 200,000 | 103,341,537 |
| Generate Token | user (ns) | sys (ns) | real (ns) |
|---|---|---|---|
| HS256 | 220,000 | 0 | 226,478 |
| HS384 | 220,000 | 0 | 218,233 |
| HS512 | 230,000 | 0 | 225,823 |
| PS256 | 1,530,000 | 10,000 | 1,536,235 |
| PS384 | 1,550,000 | 0 | 1,549,844 |
| PS512 | 1,520,000 | 10,000 | 1,524,844 |
| RS256 | 1,520,000 | 10,000 | 1,524,565 |
| RS384 | 1,530,000 | 0 | 1,528,074 |
| RS512 | 1,510,000 | 0 | 1,526,089 |
| Load Key | user (ns) | sys (ns) | real (ns) |
|---|---|---|---|
| RSA | 210,000 | 3,000 | 210,791 |
| Verify Token | user (ns) | sys (ns) | real (ns) |
|---|---|---|---|
| HS256 | 100,000 | 0 | 101,478 |
| HS384 | 100,000 | 10,000 | 103,014 |
| HS512 | 110,000 | 0 | 104,323 |
| PS256 | 230,000 | 0 | 231,058 |
| PS384 | 240,000 | 0 | 237,551 |
| PS512 | 240,000 | 0 | 232,450 |
| RS256 | 230,000 | 0 | 227,737 |
| RS384 | 230,000 | 0 | 230,698 |
| RS512 | 230,000 | 0 | 228,624 |
1 maintainer
Release files for python-jwt 4.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| python_jwt-4.1.0.tar.gz | 291.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| python_jwt-4.1.0-py2.py3-none-any.whl | Python 3, Python 2 | none | any | Details |
Total release size: 298.3 kB
Release files / python_jwt-4.1.0.tar.gz
| Download URL | python_jwt-4.1.0.tar.gz |
|---|---|
| Size | 291.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f89af071d9bda4741bc80754bd1cfce73e434a2cbb7855086d8604a10bd3fdc5
|
|
BLAKE2b-256 checksum How to use checksums |
77e6583bac8fa3fbdfd36db587d053a9c4d3692b6d345400d94e278e630b8543
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.6
|
Release files / python_jwt-4.1.0-py2.py3-none-any.whl
| Download URL | python_jwt-4.1.0-py2.py3-none-any.whl |
|---|---|
| Size | 7.1 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
1f4d44b6b9176375489c0374c71f18f27f52524e689174e11dd39a801170c91b
|
|
BLAKE2b-256 checksum How to use checksums |
18b84c404573791c4ead576d9d98f2749d41f3c61ce293cf07f7960232ec9b74
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.6
|
