JOSE and JWT

joserfc

Sign, encrypt, and validate standards-based JSON security objects.

joserfc is the focused home for Authlib's JOSE work. Its redesigned, typed API keeps signing, encryption, key handling, algorithms, token decoding, and claims validation explicit while following the relevant RFCs.

Read the docs View source PyPI

pip install joserfc

What it covers

A focused surface for JOSE and JWT.

A standalone, type-hinted implementation of JWS, JWE, JWK, JWA, and JWT.

01

Signed content

Create and verify JWS messages and JWTs with compact or JSON serialization and explicit algorithm selection.

02

Encrypted content

Encrypt and decrypt JWE messages using registered key-management and content-encryption algorithms.

03

Keys and claims

Import JWK material, calculate thumbprints, manage algorithms, decode tokens, and validate JWT claims separately.

Coverage

JWSJWEJWKJWAJWTRFC 7515-7519JWK ThumbprintsEdDSAType hints

Quickstart

Start with the smallest useful example.

Install joserfc, try this focused path, then move into the project documentation for configuration, security notes, and production guidance.

Continue in the docs

Encode and decode a JWT

from joserfc import jwt, jwk

key = jwk.import_key("your-secret-key", "oct")
encoded = jwt.encode({"alg": "HS256"}, {"sub": "user-123"}, key)

token = jwt.decode(encoded, key)
print(token.header)
print(token.claims)

Project family

Explore the related libraries.

Migration

Moving from authlib.jose?

joserfc uses a redesigned API with explicit key objects and separate claims validation. Follow the migration guide for JWT, JWK, JWS, and JWE changes.

Read the migration guide