jwtk/jjwt

★ 11,064JavaAudience · developerComplexity · 2/5LicenseSetup · easy

Mindmap

mindmap
  root((JJWT))
    Token types
      Plain JWT
      Signed JWS
      Encrypted JWE
    Algorithms
      HMAC HS256 HS512
      RSA RS256 PS256
      ECDSA ES256
      EdDSA Ed25519
    Key formats
      SecretKey
      RSA keys
      EC keys
      JSON Web Keys
    Platforms
      Java 8 plus
      Android
    Build tools
      Maven
      Gradle

mindmap root((JJWT)) Token types Plain JWT Signed JWS Encrypted JWE Algorithms HMAC HS256 HS512 RSA RS256 PS256 ECDSA ES256 EdDSA Ed25519 Key formats SecretKey RSA keys EC keys JSON Web Keys Platforms Java 8 plus Android Build tools Maven Gradle

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Issue authentication tokens in a Java backend after user login, then verify them on each subsequent API request.

USE CASE 2

Pass user identity claims between microservices securely without requiring database lookups on every call.

USE CASE 3

Encrypt sensitive user data inside a JWT payload so third-party services can relay tokens without reading their contents.

USE CASE 4

Generate and parse JSON Web Keys (JWKs) to share public keys between services for token verification.

Tech stack

JavaAndroidJacksonGsonMavenGradle

Getting it running

Difficulty · easy Time to first run · 30min

Requires three separate Maven/Gradle dependencies: API, implementation (runtime-only), and a JSON adapter, Android also needs Proguard rules.

Apache 2.0, use freely in any project including commercial, as long as you include the copyright and license notice.

In plain English

JJWT is a Java library for creating, signing, and verifying JSON Web Tokens. A JWT is a compact piece of text that carries information about a user or system in a way that can be trusted. JWTs are most commonly used for authentication: a server issues a token after a user logs in, and other services verify that token without hitting a database. JJWT handles all the cryptographic work behind the scenes through a simple, readable builder API. The library supports three types of tokens. A plain JWT carries claims with no security protection. A signed JWT (called a JWS) adds a digital signature so any party with the right key can confirm the data has not been modified. An encrypted JWT (called a JWE) goes further by hiding the payload entirely so only authorized parties can read it. JJWT covers all standard signing algorithms (HMAC, RSA, ECDSA, EdDSA) and all standard encryption algorithms defined in the JOSE specifications. Working with the API looks like this: call a builder, set a subject claim, sign it with a key, and call compact() to get a short string you can pass in HTTP headers or URLs. Verifying is a single line: parse it with the same key, and the library throws an exception if the signature fails or the token has expired. JJWT also handles JSON Web Keys (JWKs), the standard format for representing cryptographic keys as JSON. The library runs on Java 8 and later, and on Android. Installation requires three dependencies via Maven or Gradle: the public API, the internal implementation (declared runtime-only so internal details can change without breaking your code), and a JSON adapter for Jackson or Gson. Android projects need Proguard rules and optionally the BouncyCastle security provider for certain advanced algorithms. JJWT is open source under the Apache 2.0 license, ships with nearly 1,700 tests at enforced 100% code coverage, and fully implements the relevant JOSE RFC specifications. The full README is longer than what was shown.

Copy-paste prompts

Prompt 1

Using the JJWT library in Java, write code to issue a signed JWT containing a user ID and expiration, then verify and parse it.

Prompt 2

With JJWT, how do I create an encrypted JWT (JWE) using RSA-OAEP key wrapping and AES-256-GCM content encryption?

Prompt 3

I'm adding JJWT to an Android project. Show me the Gradle dependencies, Proguard rules, and BouncyCastle provider setup I need.

Prompt 4

Using JJWT, write a filter or interceptor that reads a Bearer token from the Authorization header, verifies the signature, and extracts the subject claim.

Open on GitHub → Explain another repo

← jwtk on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.