PHPackages                             adhocore/jwt - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. adhocore/jwt

ActiveLibrary[Authentication & Authorization](/categories/authentication)

adhocore/jwt
============

Ultra lightweight JSON web token (JWT) library for PHP5.5+.

v1.1.4(1mo ago)3031.8M—6.7%22[3 issues](https://github.com/adhocore/php-jwt/issues)[1 PRs](https://github.com/adhocore/php-jwt/pulls)20MITPHPPHP ^7.0 || ^8.0

Since Apr 13Pushed 1mo ago8 watchersCompare

[ Source](https://github.com/adhocore/php-jwt)[ Packagist](https://packagist.org/packages/adhocore/jwt)[ Fund](https://paypal.me/ji10)[ GitHub Sponsors](https://github.com/adhocore)[ RSS](/packages/adhocore-jwt/feed)WikiDiscussions main Synced 2d ago

READMEChangelog (10)Dependencies (2)Versions (19)Used By (20)

adhocore/jwt
------------

[](#adhocorejwt)

If you are new to JWT or want to refresh your familiarity with it, please check [jwt.io](https://jwt.io/)

[![Latest Version](https://camo.githubusercontent.com/9ce9650a6cf7906735d7d7bd9856200f526e3b08bd879b6a8c96951e3e157fa4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f6164686f636f72652f7068702d6a77742e7376673f7374796c653d666c61742d737175617265)](https://github.com/adhocore/php-jwt/releases)[![Build](https://github.com/adhocore/php-jwt/actions/workflows/build.yml/badge.svg)](https://github.com/adhocore/php-jwt/actions/workflows/build.yml)[![Scrutinizer CI](https://camo.githubusercontent.com/91e85b55d66eaafef1503e9c211b2e1a86f370b591759c6ad4d8913143d2b6cb/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f672f6164686f636f72652f7068702d6a77742e7376673f7374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/adhocore/php-jwt/?branch=master)[![Codecov branch](https://camo.githubusercontent.com/f9107c7858af9ea2fc43016cc9231db8735ab05ba0fea4efe7946139baf78378/68747470733a2f2f696d672e736869656c64732e696f2f636f6465636f762f632f6769746875622f6164686f636f72652f7068702d6a77742f6d61737465722e7376673f7374796c653d666c61742d737175617265)](https://codecov.io/gh/adhocore/php-jwt)[![StyleCI](https://camo.githubusercontent.com/8b14ffa296c256947e87d0196276c9ca2ee19e8e6817e09d51cf504e79884ef6/68747470733a2f2f7374796c6563692e696f2f7265706f732f38383136383133372f736869656c64)](https://styleci.io/repos/88168137)[![Software License](https://camo.githubusercontent.com/55c0218c8f8009f06ad4ddae837ddd05301481fcf0dff8e0ed9dadda8780713e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e7376673f7374796c653d666c61742d737175617265)](LICENSE)[![Tweet](https://camo.githubusercontent.com/cb820a0ecc9645168e33b03925d7f14691262ddbaeaf66a0a91697803d0cba2d/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f75726c2f687474702f736869656c64732e696f2e7376673f7374796c653d736f6369616c)](https://twitter.com/intent/tweet?text=Lightweight+JSON+Web+Token+JWT+library+for+PHP7&url=https://github.com/adhocore/php-jwt&hashtags=php,jwt,auth)[![Support](https://camo.githubusercontent.com/6687993dc9b60228356720a501b7c197c8c9a82194cac1b1c72d0dea95e6ad32/68747470733a2f2f696d672e736869656c64732e696f2f7374617469632f76313f6c6162656c3d537570706f7274266d6573736167653d254532253944254134266c6f676f3d476974487562)](https://github.com/sponsors/adhocore)

- Lightweight JSON Web Token (JWT) library for PHP7, PHP8 and beyond.
- Zero dependency (no vendor bloat).
- If you still use PHP5.6, use version [0.1.2](https://github.com/adhocore/php-jwt/releases/tag/0.1.2)

Installation
------------

[](#installation)

```
# PHP7.x, PHP8.x
composer require adhocore/jwt

# PHP5.6 (deprecated)
composer require adhocore/jwt:0.1.2

# For PHP5.4-5.5 (deprecated), use version 0.1.2 with a polyfill for https://php.net/hash_equals
```

Features
--------

[](#features)

- Six algorithms supported:

```
'HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512'

```

- `kid` support.
- Leeway support 0-120 seconds.
- Timestamp spoofing for tests.
- Passphrase support for `RS*` algos.

Usage
-----

[](#usage)

```
use Ahc\Jwt\JWT;

// Instantiate with key, algo, maxAge and leeway.
$jwt = new JWT('secret', 'HS256', 3600, 10);
```

> Only the key is required. Defaults will be used for the rest:

```
$jwt = new JWT('secret');
// algo = HS256, maxAge = 3600, leeway = 0
```

> For `RS*` algo, the key should be either a resource like below:

```
$key = openssl_pkey_new([
    'digest_alg' => 'sha256',
    'private_key_bits' => 1024,
    'private_key_type' => OPENSSL_KEYTYPE_RSA,
]);
```

> OR, a string with full path to the RSA private key like below:

```
$key = '/path/to/rsa.key';

// Then, instantiate JWT with this key and RS* as algo:
$jwt = new JWT($key, 'RS384');
```

***Pro***You dont need to specify pub key path, that is deduced from priv key.

> Generate JWT token from payload array:

```
$token = $jwt->encode([
    'uid'    => 1,
    'aud'    => 'http://site.com',
    'scopes' => ['user'],
    'iss'    => 'http://api.mysite.com',
]);
```

> Retrieve the payload array:

```
$payload = $jwt->decode($token);
```

> Oneliner:

```
$token   = (new JWT('topSecret', 'HS512', 1800))->encode(['uid' => 1, 'scopes' => ['user']]);
$payload = (new JWT('topSecret', 'HS512', 1800))->decode($token);
```

***Pro***

> Can pass extra headers into encode() with second parameter:

```
$token = $jwt->encode($payload, ['hdr' => 'hdr_value']);
```

#### Test mocking

[](#test-mocking)

> Spoof time() for testing token expiry:

```
$jwt->setTestTimestamp(time() + 10000);

// Throws Exception.
$jwt->parse($token);
```

> Call again without parameter to stop spoofing time():

```
$jwt->setTestTimestamp();
```

#### Examples with `kid`

[](#examples-with-kid)

```
$jwt = new JWT(['key1' => 'secret1', 'key2' => 'secret2']);

// Use key2
$token = $jwt->encode(['a' => 1, 'exp' => time() + 1000], ['kid' => 'key2']);

$payload = $jwt->decode($token);

$token = $jwt->encode(['a' => 1, 'exp' => time() + 1000], ['kid' => 'key3']);
// -> Exception with message Unknown key ID key3
```

Stabillity
----------

[](#stabillity)

The library is now marked at version `1.*.*` as being stable in functionality and API.

### Integration

[](#integration)

#### Phalcon

[](#phalcon)

Check [adhocore/phalcon-ext](https://github.com/adhocore/phalcon-ext).

### Consideration

[](#consideration)

Be aware of some security related considerations as outlined [here](http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/) which can be valid for any JWT implementations.

###  Health Score

69

—

FairBetter than 100% of packages

Maintenance93

Actively maintained with recent releases

Popularity60

Solid adoption and visibility

Community34

Small or concentrated contributor base

Maturity77

Established project with proven stability

 Bus Factor1

Top contributor holds 89.8% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~222 days

Recently: every ~515 days

Total

16

Last Release

34d ago

Major Versions

0.1.2 → 1.0.02019-12-13

PHP version history (3 changes)v0.0.1PHP >=7.0

v0.0.6PHP >=5.5

1.1.1PHP ^7.0 || ^8.0

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/2908547?v=4)[Jitendra Adhikari](/maintainers/adhocore)[@adhocore](https://github.com/adhocore)

---

Top Contributors

[![adhocore](https://avatars.githubusercontent.com/u/2908547?v=4)](https://github.com/adhocore "adhocore (114 commits)")[![Meldiron](https://avatars.githubusercontent.com/u/19310830?v=4)](https://github.com/Meldiron "Meldiron (4 commits)")[![StyleCIBot](https://avatars.githubusercontent.com/u/11048387?v=4)](https://github.com/StyleCIBot "StyleCIBot (2 commits)")[![magnetik](https://avatars.githubusercontent.com/u/345029?v=4)](https://github.com/magnetik "magnetik (2 commits)")[![JorisvanW](https://avatars.githubusercontent.com/u/11089853?v=4)](https://github.com/JorisvanW "JorisvanW (1 commits)")[![stoyan0v](https://avatars.githubusercontent.com/u/22631418?v=4)](https://github.com/stoyan0v "stoyan0v (1 commits)")[![yuliyan-m](https://avatars.githubusercontent.com/u/117639947?v=4)](https://github.com/yuliyan-m "yuliyan-m (1 commits)")[![peter279k](https://avatars.githubusercontent.com/u/9021747?v=4)](https://github.com/peter279k "peter279k (1 commits)")[![dependabot-preview[bot]](https://avatars.githubusercontent.com/in/2141?v=4)](https://github.com/dependabot-preview[bot] "dependabot-preview[bot] (1 commits)")

---

Tags

adhocoreapi-authapi-securityjson-web-signaturejson-web-tokenjson-web-token-phpjwtjwt-authjwt-authenticationoauth2phpphp-jwtphp7php8jwtauthtokenJSON Web Tokenjwt-phpjwt-auth

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/adhocore-jwt/health.svg)

```
[![Health](https://phpackages.com/badges/adhocore-jwt/health.svg)](https://phpackages.com/packages/adhocore-jwt)
```

###  Alternatives

[tymon/jwt-auth

JSON Web Token Authentication for Laravel and Lumen

11.7k51.8M371](/packages/tymon-jwt-auth)[namshi/jose

JSON Object Signing and Encryption library for PHP.

1.8k103.2M104](/packages/namshi-jose)[php-open-source-saver/jwt-auth

JSON Web Token Authentication for Laravel and Lumen

84611.1M63](/packages/php-open-source-saver-jwt-auth)[auth0/auth0-php

PHP SDK for Auth0 Authentication and Management APIs.

41021.9M91](/packages/auth0-auth0-php)[auth0/login

Auth0 Laravel SDK. Straight-forward and tested methods for implementing authentication, and accessing Auth0's Management API endpoints.

2795.3M3](/packages/auth0-login)[auth0/symfony

Symfony SDK for Auth0 Authentication and Management APIs.

128814.6k](/packages/auth0-symfony)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)