JWT

Compact JWT signing and verification with explicit algorithm selection and strict JWA signature encoding.

Installation

composer config repositories.localzet-jwt vcs https://github.com/localzet/JWT
composer require localzet/jwt:dev-main

JWT, JWS and JWE

The repository exposes JWT::encode/decode, JWS::sign/verify, JWK::generate_key and JWE::encrypt. An encrypt method does not establish a complete decryption path: inspect available methods at the pinned revision. JWT payloads are encoded, not necessarily encrypted.

Verification must constrain the algorithm and expected issuer/audience, validate temporal claims and token purpose. Never select algorithms or keys solely from an untrusted header. Examples do not constitute a cryptographic audit. JOSE and jwt-lab continue this research family rather than being guaranteed drop-in releases.

Requirements

• php: >=8.2
• ext-openssl: *
• ext-mbstring: *
• ext-json: *

Source · AGPL-3.0