jsonwebtoken
A Node.js library for creating and checking JSON Web Tokens (JWTs).auth0/node-jsonwebtoken
- Stars
- 18.2k
- Forks
- 1.3k
- Licence
- MIT
- Language
- JavaScript
- Last update
- 4 months ago
- Type
- Library
What it is
jsonwebtoken is a JavaScript package for Node.js that creates signed JSON Web Tokens and verifies them. A JWT is a compact string that carries claims, such as who the user is and when the token expires, and a signature so the receiver can check it was not altered. Developers use it to handle login sessions and to authorize requests to their servers.
- Issue a token with an expiry of one hour after a user logs in
- Verify an incoming token's signature and check its audience or issuer before serving a request
- Sign tokens with an RS256 private key and verify them with the matching public key
Great for
- Node.js developers adding token-based authentication to an API
- Teams that need to sign tokens with a shared secret (HMAC) or an RSA/ECDSA key pair
- Developers who want expiration (exp), not-before, audience, or issuer checks handled by the library
Not ideal for
- Non-programmers, since it is a code library rather than an app
- Projects not using Node.js, because the package is written for Node.js
- Anyone expecting it to handle full login flows, user storage, or key management on its own; the README only covers signing and verifying
How to get it
- 1
Install with a package manager
You'll need: Node.js
Install the package
npm install jsonwebtoken - 2
Run it
- Install the package with npm install jsonwebtoken
- Require it in your code with var jwt = require('jsonwebtoken')
- Create a token with jwt.sign({ foo: 'bar' }, 'shhhhh')
- Check the token with jwt.verify(token, 'shhhhh') using the same secret
- 3
Get the most out of it
- Set expiresIn (for example '1h') so tokens do not last forever
- Pass the algorithms option to verify to restrict which algorithms are accepted
- Use RS256 with a private/public key pair when other services need to verify tokens without the signing secret
- Use the complete option on verify to read the header and signature as well as the payload
- Use clockTolerance to allow for small clock differences between servers
Downloads
Strengths
- Widely used, with about 18,000 stars and an MIT license
- Supports both HMAC secrets and RSA/ECDSA keys, with both synchronous and callback-based calls
- Includes built-in checks for expiration, audience, issuer, and subject
Trade-offs
- The README says the decoded payload from untrusted sources must still be sanitized by the developer
- Several behaviors are controlled by options, so correct configuration matters; for example, algorithms should be restricted on verify
- The README is truncated and the migration notes point to external wiki pages for version changes
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.