Repolode
Submit
jwtk

jwtk/jjwt

Java library for creating, parsing and verifying JSON Web Tokens (JWT) and JSON Web Keys (JWK) on the JVM and Android.

View on GitHub
Stars
11,144
Forks
1,401
Open issues
49
Last commit
last month

What is it?

JJWT is a pure Java implementation of the JOSE specifications for JSON Web Tokens, covering signed (JWS), encrypted (JWE), and key (JWK) formats. It aims to make creating and verifying tokens straightforward, using a fluent builder API and automatic security checks.

The library supports all standard JWS signature algorithms (HMAC, ECDSA, RSA and EdDSA) and the JWE encryption and key management algorithms. Claims such as expiration and not-before can be asserted during parsing, and payloads can be compressed. Claim objects can be marshaled through Jackson or Gson.

JJWT runs on Java 8+ and Android. Its API module is the only compile-time dependency, while the implementation and JSON processor are declared as runtime dependencies, with Maven and Gradle setup and Android ProGuard rules documented.

Key features

  • 01Creates, parses and verifies signed JWTs (JWS) with HS, ES, RS, PS and EdDSA algorithms.
  • 02Supports JWE encryption and decryption with standard AEAD and key management algorithms.
  • 03Creates, parses and verifies JSON Web Keys for common Java key types.
  • 04Fluent builder API designed for IDE auto-completion.
  • 05Claim assertions and POJO marshaling via Jackson or Gson.

Use cases

  • Issuing and verifying access tokens in a Java or Spring backend service.
  • Adding token-based authentication to an Android app.
  • Encrypting sensitive claims inside a token with JWE.
  • Publishing or consuming JSON Web Key sets in an identity integration.

Things to know

  • Non-compact JWS serialization and parsing are not supported.
  • PS256/PS384/PS512 need Java 11+ or a compatible JCA provider such as BouncyCastle.
  • EdDSA and XDH keys need Java 15+ or a compatible JCA provider such as BouncyCastle.

In collections

Android apps & phone toolsLogin, SSO & identity servers

Topics

#jwt#java#jws#jwe#authentication#android#jwk#hacktoberfest#jackson#java-jwt

FAQ

What is jjwt?
Java library for creating, parsing and verifying JSON Web Tokens (JWT) and JSON Web Keys (JWK) on the JVM and Android. JJWT is a pure Java implementation of the JOSE specifications for JSON Web Tokens, covering signed (JWS), encrypted (JWE), and key (JWK) formats. It aims to make creating and verifying tokens straightforward, using a fluent builder API and automatic security checks.
Is jjwt free to use? What license does it have?
jjwt is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is jjwt still maintained?
Updated within 6 months. The last commit to jjwt was on Oct 4, 2026.
What can I use jjwt for?
Issuing and verifying access tokens in a Java or Spring backend service. Adding token-based authentication to an Android app. Encrypting sensitive claims inside a token with JWE. Publishing or consuming JSON Web Key sets in an identity integration.
Where can I get jjwt?
The source code and installation instructions are on GitHub: https://github.com/jwtk/jjwt

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects