Authentication & Authorization Packages
Authentication, authorization, and identity/session libraries for handling login, permissions, and access control securely (JWT, Passport, Sanctum).
Packages in Authentication & Authorization
Kind
Sort:Used by Most Apps
jwt
A zero-dependency Go implementation of JSON Web Tokens (JWT) with pluggable HMAC, RSA, RSA-PSS, ECDSA, and Ed25519 signing methods.
PyJWT
A Python implementation of RFC 7519 for encoding, decoding, and verifying JSON Web Tokens.
Better Auth
The most comprehensive, framework-agnostic authentication and authorization framework for TypeScript.
express-rate-limit
Basic IP rate-limiting middleware for Express to throttle repeated requests and protect public APIs and sensitive endpoints.
otplib
TypeScript-first TOTP and HOTP library with a pluggable crypto/base32 architecture for Node, Bun, Deno, and browsers.
itsdangerous
A small Python toolkit for cryptographically signing data so you can trust it hasn't been tampered with when it comes back from an untrusted client.
OTPAuth
HOTP and TOTP one-time password library for Node.js, Deno, Bun, and browsers
zxcvbn
A realistic password strength estimator that models how attackers actually guess passwords, not arbitrary composition rules.
webauthn
A spec-conformant WebAuthn and FIDO2 passkey server library for Go, handling registration and authentication ceremonies for passwordless and multi-factor login.
argon2-cffi
Secure, high-level password hashing for Python using Argon2
zxcvbn-ts
A TypeScript rewrite of Dropbox's zxcvbn password strength estimator, with pluggable dictionaries and async matcher support.
Vault API
The official Go client library for HashiCorp Vault, providing typed access to secrets, auth methods, and system endpoints.
TwoFactorAuth
PHP library for TOTP-based two-factor authentication with pluggable QR code providers
rpassword
Cross-platform Rust library for securely reading passwords from the terminal.
iron-session
Secure, stateless, cookie-based session library for Next.js and any JavaScript framework
Bouncer
Elegant roles and abilities authorization for Laravel using Eloquent.
zxcvbn-python
A Python port of Dropbox's zxcvbn - realistic password strength estimation with crack-time estimates and specific improvement feedback.
openidconnect-rs
A strongly-typed, extensible Rust implementation of the OpenID Connect protocol for building relying-party authentication and OIDC provider integrations.
@badgateway/oauth2-client
Dependency-free OAuth2 client for Node.js and browsers with PKCE and token refresh
python-gssapi
Python bindings for RFC 2743/2744 GSSAPI, giving Python code direct, Pythonic access to Kerberos and other GSSAPI security mechanisms.
scheb/2fa-bundle
A generic interface to add two-factor authentication to Symfony applications.
accesscontrol
Role- and attribute-based access control (RBAC + ABAC) for Node.js, with enforced ownership, conditions, and require() gates.
djangorestframework-api-key
API key permissions for Django REST Framework, with secure hashing and admin-managed keys.
webauthn-rs
A Rust implementation of the WebAuthn Relying Party protocol for passkey and passwordless authentication.
