PHPackages horde/jwt - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. horde/jwt ActiveLibrary[Authentication & Authorization](/categories/authentication) horde/jwt ========= Horde RFC 7519 JSON Web Token (JWT) Library v1.0.0(1mo ago)01.3k↑200%11LGPL-2.1PHPPHP ^8.1 Since Apr 18Pushed 1mo agoCompare [ Source](https://github.com/horde/Jwt)[ Packagist](https://packagist.org/packages/horde/jwt)[ Docs](http://www.horde.org/libraries/Horde_Jwt)[ RSS](/packages/horde-jwt/feed)WikiDiscussions FRAMEWORK\_6\_0 Synced 3w ago READMEChangelog (2)DependenciesVersions (4)Used By (1) Horde\\Jwt ========== [](#hordejwt) A standalone, zero-framework-dependency PHP library for creating, signing and verifying JSON Web Tokens ([RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519)). Part of the [Horde Project](https://www.horde.org/). Features -------- [](#features) - **HS256** (HMAC-SHA256) symmetric signing and verification - **RS256** (RSA-SHA256) asymmetric signing and verification - **ES256** (ECDSA P-256) asymmetric signing and verification - Configurable claim validation: `exp`, `nbf`, `iss`, `aud` with clock skew leeway - Typed key wrappers (`PrivateKey`, `PublicKey`) with PEM file/string loading - JWK public key serialization ([RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517)) for RSA and EC keys - Clean `SignerInterface` / `VerifierInterface` abstractions for extending with additional algorithms - PHP 8.1+, strict types, no external dependencies beyond `ext-openssl` and `ext-hash` Installation ------------ [](#installation) ``` composer require horde/jwt ``` Quick Example ------------- [](#quick-example) ``` use Horde\Jwt\Signer\Hs256Signer; use Horde\Jwt\TokenDecoder; use Horde\Jwt\TokenEncoder; use Horde\Jwt\Verifier\Hs256Verifier; $secret = 'your-secret-key-at-least-32-bytes!'; $encoder = new TokenEncoder(); $decoder = new TokenDecoder(); // Sign $token = $encoder->encode(['sub' => 'user123', 'iss' => 'myapp'], new Hs256Signer($secret)); // Verify $verified = $decoder->decode($token->toString(), new Hs256Verifier($secret), [ 'verify_iss' => 'myapp', ]); echo $verified->getSubject(); // 'user123' ``` See [doc/USAGE.md](doc/USAGE.md) for full documentation covering all algorithms, key management, verification options and error handling. Heritage and Upgrading ---------------------- [](#heritage-and-upgrading) This library extracts and generalizes JWT code that previously lived as special-case implementations in: - **[horde/core](https://github.com/horde/Core)**`Horde\Core\Auth\Jwt\Hs256Generator`, `Rs256Generator`, `JwtVerifier`, and related classes used for Horde session tokens - **[horde/components](https://github.com/horde/components)**`Horde\Components\Auth\Rs256JwtGenerator` and GitHub App authentication wrappers Those packages contained duplicated base64url encoding, key handling and signing logic, with use-case-specific interfaces (GitHub App IDs, Horde session conventions) that prevented reuse. `horde/jwt` replaces the algorithmic layer with a general-purpose design while adding ES256 support, typed key objects, JWK serialization and structured exceptions. If you consumed the Core or Components JWT classes directly, see [doc/UPGRADING.md](doc/UPGRADING.md) for a class-by-class migration guide. The framework-level services (`JwtService`, `JwtServiceFactory`, `JwtAuthMiddleware`, `GitHubAppAuthenticationService`) remain in their respective packages and will be updated to delegate to `horde/jwt`. Relationship to horde/Oauth --------------------------- [](#relationship-to-hordeoauth) [horde/Oauth](https://github.com/horde/Oauth) provides the OAuth protocol implementation for the Horde framework. `horde/jwt` handles the token format layer concerns such as creating and verifying JWTs. OAuth 2.0 and OpenID Connect build upon this foundation. The two libraries are complementary: - **horde/jwt**: token signing, verification, key management (this library) - **horde/Oauth**: OAuth 2.0 authorization flows, token endpoints, OIDC discovery and protocol-level concerns `horde/jwt` has no dependency on `horde/oauth` or any other Horde package. What This Library Is -------------------- [](#what-this-library-is) - A general-purpose JWT signing and verification library - A building block for OAuth 2.0, OpenID Connect, or any JWT-based protocol - Usable standalone, outside the Horde framework What This Library Is Not ------------------------ [](#what-this-library-is-not) - Not an OAuth 2.0 or OpenID Connect implementation (see horde/oauth) - Not a session management system (see `Horde\Core\Auth\Jwt\JwtService`) - Not an HTTP middleware or authentication framework - Not a JWKS endpoint server (it provides JWK *serialization*; serving JWKS over HTTP is an application concern) Relevant RFCs ------------- [](#relevant-rfcs) - [RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519) - JSON Web Token (JWT) - [RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515) - JSON Web Signature (JWS) - [RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516) - JSON Web Encryption (JWE) *(not implemented)* - [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517) - JSON Web Key (JWK) - [RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518) - JSON Web Algorithms (JWA) Requirements ------------ [](#requirements) - PHP 8.1 or later - `ext-openssl` - `ext-hash` License ------- [](#license) LGPL-2.1-only. See [LICENSE](LICENSE) for details. ### Health Score 45 — FairBetter than 91% of packages Maintenance92 Actively maintained with recent releases Popularity22 Limited adoption so far Community15 Small or concentrated contributor base Maturity45 Maturing project, gaining track record Bus Factor1 Top contributor holds 88.9% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~58 days Total 2 Last Release 40d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/c931cd02664859360478593450d6c473a05bb12b209dfacfc534cd13257cc7ef?d=identicon)[ralflang](/maintainers/ralflang) ![](https://www.gravatar.com/avatar/e4f6c6771993db2ed500959b42353f6cf6a2ca0406d9617f7ae680f4504faa4a?d=identicon)[horde](/maintainers/horde) ![](https://www.gravatar.com/avatar/816e2b926f25f8cd2939054c7a7173011b4303d690e25ab61bf33cf8c7cf71ae?d=identicon)[tdannhauer](/maintainers/tdannhauer) --- Top Contributors [![ralflang](https://avatars.githubusercontent.com/u/646976?v=4)](https://github.com/ralflang "ralflang (8 commits)")[![TDannhauer](https://avatars.githubusercontent.com/u/6716033?v=4)](https://github.com/TDannhauer "TDannhauer (1 commits)") --- Tags RFC7519authclaims ### Embed Badge ![Health badge](/badges/horde-jwt/health.svg) ``` [![Health](https://phpackages.com/badges/horde-jwt/health.svg)](https://phpackages.com/packages/horde-jwt) ``` ### Alternatives [tymon/jwt-auth JSON Web Token Authentication for Laravel and Lumen 11.5k51.8M375](/packages/tymon-jwt-auth)[league/oauth2-server A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API. 6.7k147.0M304](/packages/league-oauth2-server)[lab404/laravel-impersonate Laravel Impersonate is a plugin that allows to you to authenticate as your users. 2.3k18.6M66](/packages/lab404-laravel-impersonate)[web-token/jwt-framework JSON Object Signing and Encryption library for PHP and Symfony Bundle. 95220.7M107](/packages/web-token-jwt-framework)[auth0/auth0-php PHP SDK for Auth0 Authentication and Management APIs. 41121.9M94](/packages/auth0-auth0-php)[kreait/firebase-tokens A library to work with Firebase tokens 23945.4M18](/packages/kreait-firebase-tokens) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)