PHPackages                             adhocore/jwt - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. adhocore/jwt

ActiveLibrary[Authentication & Authorization](/categories/authentication)

adhocore/jwt
============

Ultra lightweight JSON web token (JWT) library for PHP5.5+.

1.1.3(1y ago)3031.6M—9.7%21[2 issues](https://github.com/adhocore/php-jwt/issues)[1 PRs](https://github.com/adhocore/php-jwt/pulls)14MITPHPPHP ^7.0 || ^8.0CI failing

Since Apr 13Pushed 1y ago9 watchersCompare

[ Source](https://github.com/adhocore/php-jwt)[ Packagist](https://packagist.org/packages/adhocore/jwt)[ Fund](https://paypal.me/ji10)[ GitHub Sponsors](https://github.com/adhocore)[ RSS](/packages/adhocore-jwt/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (10)Dependencies (1)Versions (17)Used By (14)

adhocore/jwt
------------

[](#adhocorejwt)

If you are new to JWT or want to refresh your familiarity with it, please check [jwt.io](https://jwt.io/)

[![Latest Version](https://camo.githubusercontent.com/9ce9650a6cf7906735d7d7bd9856200f526e3b08bd879b6a8c96951e3e157fa4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f6164686f636f72652f7068702d6a77742e7376673f7374796c653d666c61742d737175617265)](https://github.com/adhocore/php-jwt/releases)[![Build](https://github.com/adhocore/php-jwt/actions/workflows/build.yml/badge.svg)](https://github.com/adhocore/php-jwt/actions/workflows/build.yml)[![Scrutinizer CI](https://camo.githubusercontent.com/91e85b55d66eaafef1503e9c211b2e1a86f370b591759c6ad4d8913143d2b6cb/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f672f6164686f636f72652f7068702d6a77742e7376673f7374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/adhocore/php-jwt/?branch=master)[![Codecov branch](https://camo.githubusercontent.com/f9107c7858af9ea2fc43016cc9231db8735ab05ba0fea4efe7946139baf78378/68747470733a2f2f696d672e736869656c64732e696f2f636f6465636f762f632f6769746875622f6164686f636f72652f7068702d6a77742f6d61737465722e7376673f7374796c653d666c61742d737175617265)](https://codecov.io/gh/adhocore/php-jwt)[![StyleCI](https://camo.githubusercontent.com/8b14ffa296c256947e87d0196276c9ca2ee19e8e6817e09d51cf504e79884ef6/68747470733a2f2f7374796c6563692e696f2f7265706f732f38383136383133372f736869656c64)](https://styleci.io/repos/88168137)[![Software License](https://camo.githubusercontent.com/55c0218c8f8009f06ad4ddae837ddd05301481fcf0dff8e0ed9dadda8780713e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d627269676874677265656e2e7376673f7374796c653d666c61742d737175617265)](LICENSE)[![Tweet](https://camo.githubusercontent.com/cb820a0ecc9645168e33b03925d7f14691262ddbaeaf66a0a91697803d0cba2d/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f75726c2f687474702f736869656c64732e696f2e7376673f7374796c653d736f6369616c)](https://twitter.com/intent/tweet?text=Lightweight+JSON+Web+Token+JWT+library+for+PHP7&url=https://github.com/adhocore/php-jwt&hashtags=php,jwt,auth)[![Support](https://camo.githubusercontent.com/6687993dc9b60228356720a501b7c197c8c9a82194cac1b1c72d0dea95e6ad32/68747470733a2f2f696d672e736869656c64732e696f2f7374617469632f76313f6c6162656c3d537570706f7274266d6573736167653d254532253944254134266c6f676f3d476974487562)](https://github.com/sponsors/adhocore)

- Lightweight JSON Web Token (JWT) library for PHP7, PHP8 and beyond.
- Zero dependency (no vendor bloat).
- If you still use PHP5.6, use version [0.1.2](https://github.com/adhocore/php-jwt/releases/tag/0.1.2)

Installation
------------

[](#installation)

```
# PHP7.x, PHP8.x
composer require adhocore/jwt

# PHP5.6 (deprecated)
composer require adhocore/jwt:0.1.2

# For PHP5.4-5.5 (deprecated), use version 0.1.2 with a polyfill for https://php.net/hash_equals
```

Features
--------

[](#features)

- Six algorithms supported:

```
'HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512'

```

- `kid` support.
- Leeway support 0-120 seconds.
- Timestamp spoofing for tests.
- Passphrase support for `RS*` algos.

Usage
-----

[](#usage)

```
use Ahc\Jwt\JWT;

// Instantiate with key, algo, maxAge and leeway.
$jwt = new JWT('secret', 'HS256', 3600, 10);
```

> Only the key is required. Defaults will be used for the rest:

```
$jwt = new JWT('secret');
// algo = HS256, maxAge = 3600, leeway = 0
```

> For `RS*` algo, the key should be either a resource like below:

```
$key = openssl_pkey_new([
    'digest_alg' => 'sha256',
    'private_key_bits' => 1024,
    'private_key_type' => OPENSSL_KEYTYPE_RSA,
]);
```

> OR, a string with full path to the RSA private key like below:

```
$key = '/path/to/rsa.key';

// Then, instantiate JWT with this key and RS* as algo:
$jwt = new JWT($key, 'RS384');
```

***Pro***You dont need to specify pub key path, that is deduced from priv key.

> Generate JWT token from payload array:

```
$token = $jwt->encode([
    'uid'    => 1,
    'aud'    => 'http://site.com',
    'scopes' => ['user'],
    'iss'    => 'http://api.mysite.com',
]);
```

> Retrieve the payload array:

```
$payload = $jwt->decode($token);
```

> Oneliner:

```
$token   = (new JWT('topSecret', 'HS512', 1800))->encode(['uid' => 1, 'scopes' => ['user']]);
$payload = (new JWT('topSecret', 'HS512', 1800))->decode($token);
```

***Pro***

> Can pass extra headers into encode() with second parameter:

```
$token = $jwt->encode($payload, ['hdr' => 'hdr_value']);
```

#### Test mocking

[](#test-mocking)

> Spoof time() for testing token expiry:

```
$jwt->setTestTimestamp(time() + 10000);

// Throws Exception.
$jwt->parse($token);
```

> Call again without parameter to stop spoofing time():

```
$jwt->setTestTimestamp();
```

#### Examples with `kid`

[](#examples-with-kid)

```
$jwt = new JWT(['key1' => 'secret1', 'key2' => 'secret2']);

// Use key2
$token = $jwt->encode(['a' => 1, 'exp' => time() + 1000], ['kid' => 'key2']);

$payload = $jwt->decode($token);

$token = $jwt->encode(['a' => 1, 'exp' => time() + 1000], ['kid' => 'key3']);
// -> Exception with message Unknown key ID key3
```

Stabillity
----------

[](#stabillity)

The library is now marked at version `1.*.*` as being stable in functionality and API.

### Integration

[](#integration)

#### Phalcon

[](#phalcon)

Check [adhocore/phalcon-ext](https://github.com/adhocore/phalcon-ext).

### Consideration

[](#consideration)

Be aware of some security related considerations as outlined [here](http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/) which can be valid for any JWT implementations.

###  Health Score

56

—

FairBetter than 98% of packages

Maintenance43

Moderate activity, may be stable

Popularity59

Moderate usage in the ecosystem

Community32

Small or concentrated contributor base

Maturity76

Established project with proven stability

 Bus Factor1

Top contributor holds 92.6% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~204 days

Recently: every ~461 days

Total

15

Last Release

455d ago

Major Versions

0.1.2 → 1.0.02019-12-13

PHP version history (3 changes)v0.0.1PHP >=7.0

v0.0.6PHP >=5.5

1.1.1PHP ^7.0 || ^8.0

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/2908547?v=4)[Jitendra Adhikari](/maintainers/adhocore)[@adhocore](https://github.com/adhocore)

---

Top Contributors

[![adhocore](https://avatars.githubusercontent.com/u/2908547?v=4)](https://github.com/adhocore "adhocore (112 commits)")[![magnetik](https://avatars.githubusercontent.com/u/345029?v=4)](https://github.com/magnetik "magnetik (2 commits)")[![StyleCIBot](https://avatars.githubusercontent.com/u/11048387?v=4)](https://github.com/StyleCIBot "StyleCIBot (2 commits)")[![peter279k](https://avatars.githubusercontent.com/u/9021747?v=4)](https://github.com/peter279k "peter279k (1 commits)")[![stoyan0v](https://avatars.githubusercontent.com/u/22631418?v=4)](https://github.com/stoyan0v "stoyan0v (1 commits)")[![yuliyan-m](https://avatars.githubusercontent.com/u/117639947?v=4)](https://github.com/yuliyan-m "yuliyan-m (1 commits)")[![dependabot-preview[bot]](https://avatars.githubusercontent.com/in/2141?v=4)](https://github.com/dependabot-preview[bot] "dependabot-preview[bot] (1 commits)")[![JorisvanW](https://avatars.githubusercontent.com/u/11089853?v=4)](https://github.com/JorisvanW "JorisvanW (1 commits)")

---

Tags

adhocoreapi-authapi-securityjson-web-signaturejson-web-tokenjson-web-token-phpjwtjwt-authjwt-authenticationoauth2phpphp-jwtphp7php8jwtauthtokenJSON Web Tokenjwt-phpjwt-auth

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/adhocore-jwt/health.svg)

```
[![Health](https://phpackages.com/badges/adhocore-jwt/health.svg)](https://phpackages.com/packages/adhocore-jwt)
```

###  Alternatives

[tymon/jwt-auth

JSON Web Token Authentication for Laravel and Lumen

11.5k49.1M350](/packages/tymon-jwt-auth)[namshi/jose

JSON Object Signing and Encryption library for PHP.

1.8k99.6M101](/packages/namshi-jose)[php-open-source-saver/jwt-auth

JSON Web Token Authentication for Laravel and Lumen

8359.8M53](/packages/php-open-source-saver-jwt-auth)[auth0/auth0-php

PHP SDK for Auth0 Authentication and Management APIs.

40820.2M68](/packages/auth0-auth0-php)[auth0/login

Auth0 Laravel SDK. Straight-forward and tested methods for implementing authentication, and accessing Auth0's Management API endpoints.

2745.0M3](/packages/auth0-login)[auth0/symfony

Symfony SDK for Auth0 Authentication and Management APIs.

128738.1k](/packages/auth0-symfony)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)