Crate jwt 

Sign, parse, and verify JSON Web Tokens (JWT).

Two-step verification flow

parse_header and parse_and_verify are separate so that you can inspect the header, especially the kid field (Key ID), before choosing which key to verify with. This is essential when the key must be looked up dynamically.

no_std support

Disable default features (default-features = false) and provide your own Clock implementation for time-based claim verification (optional).

Example

use jwt::*;

fn main() -> Result<(), Error> {
    // 1. Generate an Ed25519 secret key.
    let secret_key = Ed25519SecretKey::generate();

    // 2. Build the header.
    let header = Header {
        typ: TokenType::JWT,
        alg: Algorithm::EdDSA,
        kid: Some("my-key-id".into()),
        cty: None,
        jku: None,
        x5u: None,
        x5c: None,
        x5t: None,
        x5t_s256: None,
    };

    // 3. Define the claims and sign.
    let claims = serde_json::json!({ "sub": "user123", "exp": 9999999999_u64 });
    let token = sign(&secret_key, &header, &claims)?;

    // 4. Extract the public key for verification.
    let public_key = secret_key.public_key();

    // 5. Parse only the header first (e.g., to read `kid` for key lookup).
    let parsed_header = parse_header(&token)?;
    assert_eq!(parsed_header.kid.as_deref(), Some("my-key-id"));

    // 6. Now verify and deserialize the claims.
    let opts = VerifyOptions {
        allowed_time_drift: core::time::Duration::from_secs(60),
        exp: true,
        nbf: false,
        aud: None,
        iss: None,
        clock: Some(&jwt::SYSTEM_CLOCK),
    };
    let claims: serde_json::Value =
        parse_and_verify(&public_key, &parsed_header, &token, &opts)?;
    assert_eq!(claims["sub"], "user123");

    Ok(())
}

JSON Web Key (JWK) import and export

Keys can be exported to and imported from JSON Web Keys (JWK) for publishing or later re-use with Jwk::from.

The Key enum represents any supported cryptographic key. Convert a JWK into a Key with Key::try_from(&Jwk), then use it directly with sign or parse_and_verify without knowing the concrete key type.

use jwt::*;

fn main() -> Result<(), Error> {
    // Generate a P-256 key pair.
    let secret_key = P256SecretKey::generate()?;
    let public_key = secret_key.public_key();

    // Convert to a JWK (e.g. for publishing in a JWKS endpoint).
    let jwk = Jwk::from(&public_key);
    assert_eq!(jwk.algorithm, Algorithm::ES256);

    // Parse the JWK back into a Key (e.g. from a JWKS response).
    let key = Key::try_from(&jwk)?;

    // sign and parse_and_verify accept &Key directly.
    let header = Header { typ: TokenType::JWT, alg: Algorithm::ES256, ..Default::default() };
    let token = sign(&secret_key, &header, &serde_json::json!({"exp": 9999999999_u64, "nbf": 0_u64 }))?;
    let parsed_header = parse_header(&token)?;
    let _claims: serde_json::Value = parse_and_verify(&key, &parsed_header, &token, &VerifyOptions::default())?;

    Ok(())
}

Structs

Blake3Key

A BLAKE3 key.

Ed25519PublicKey

Ed25519SecretKey

Header

HmacSha256Key

A HS256 key.

HmacSha512Key

A HS512 key.

Jwk

a JSON Web Key https://www.rfc-editor.org/rfc/rfc7517 https://www.rfc-editor.org/rfc/rfc8037 Note: Jwk are not validated during deserialization

Jwks

P256PublicKey

P256SecretKey

RegisteredClaims

Registered claim names from https://www.rfc-editor.org/rfc/rfc7519#section-4.1

RsaPublicKey

An RSA public key for JWT verification, supporting both PKCS#1 v1.5 and RSA-PSS signatures.

Signature

SystemClock

A Clock backed by std::time::SystemTime.

VerifyOptions

Enums

Algorithm

The algorithms supported for signing / verifying JWTs

EcCurve

Error

JwkCrypto

Key

A concrete cryptographic key extracted from and that can be converted to a Jwk.

KeyUse

OkpCurve

TokenType

Statics

SYSTEM_CLOCK

Traits

Clock

A wall clock used to check tokens expiration.

Signer

Verifier

Functions

parse_and_verify

parse_header

sign