jwt

golang-jwt/jwt is the community-maintained continuation of the original dgrijalva/jwt-go, implementing the JSON Web Token standard (RFC 7519) for Go applications. It provides a Token type and Parser for creating, signing, and verifying JWTs, with a pluggable SigningMethod registry that ships HMAC-SHA, RSA, RSA-PSS, ECDSA, and EdDSA/Ed25519 out of the box.

Beyond signature verification, the library includes a dedicated Validator for checking expiration, not-before, issued-at, audience, issuer, and subject claims, plus support for fully custom claim types via the Claims interface. A companion request sub-package adds extractors for pulling tokens out of HTTP headers, query parameters, and OAuth2-style forms, making it a complete building block for stateless authentication in Go services.

What You Get

• A Token type plus New/NewWithClaims/Parse/ParseWithClaims functions for building and verifying JWTs
• Built-in signing methods for HMAC-SHA (HS256/384/512), RSA and RSA-PSS, ECDSA, and EdDSA/Ed25519 behind a common SigningMethod interface
• A validation API (Validator, ParserOptions) for expiration, not-before, issued-at, audience, issuer, and subject claim checks with configurable leeway
• MapClaims and RegisteredClaims implementations of the Claims interface, with support for fully custom claim types
• A request sub-package with extractors for pulling tokens out of HTTP headers, query params, and OAuth2-style forms

Common Use Cases

• Issuing and verifying bearer tokens for stateless API authentication
• Implementing OAuth2-style access tokens for a Go backend service
• Validating third-party JWTs (e.g. from an identity provider) before trusting their claims
• Embedding custom application claims (roles, tenant IDs) in a signed token passed between services

Under The Hood

Architecture - A Token struct holds Raw/Method/Header/Claims/Signature/Valid. New/NewWithClaims build a Token; SignedString computes the signing string (base64url-encoded JSON header and claims joined by ’.’), calls Method.Sign to produce a signature, and appends it. Parsing flows through Parse/ParseWithClaims into ParseUnverified, which splits the token into three segments, base64-decodes header/claims/signature, and resolves the SigningMethod from the header’s alg via a global registry. ParseWithClaims then checks the method against an optional allow-list, invokes the caller-supplied Keyfunc to obtain a verification key (a single key or a VerificationKeySet for key rotation), calls Method.Verify, and runs Validator.Validate for claim checks (exp/nbf/iat/aud/iss/sub) unless skipped. SigningMethod is a minimal interface (Sign/Verify/Alg) backed by a registry map guarded by sync.RWMutex, populated via init() in each algorithm file, letting third parties register new algorithms without touching core code. A request sub-package layers pluggable Extractors on top for pulling raw tokens out of *http.Request.

Tech Stack - Pure Go standard library: go.mod declares module github.com/golang-jwt/jwt/v5 at go 1.21 with an empty go.sum (zero third-party dependencies). It relies solely on crypto, crypto/hmac, crypto/rsa, crypto/ecdsa, crypto/ed25519, encoding/base64, encoding/json, and slices/errors from stdlib, with GitHub Actions driving CI. This zero-dependency, stdlib-only design is a deliberate strength for a security-sensitive library, minimizing supply-chain surface area.

Code Quality - 19 _test.go files against 27 non-test .go files, covering nearly every signing algorithm plus parser and validator logic (parser_test.go alone runs to 36KB), with example_test.go and http_example_test.go serving as executable documentation. Errors are modeled as sentinel vars wrapped through a custom newError/joinedError helper supporting Go 1.20+ multi-error %w wrapping compatible with errors.Is/As, rather than ad hoc string errors. Naming is idiomatic and consistent, and doc comments are extensive with links to the project’s usage guide.

API Design - Getting started is a two-line NewWithClaims(…).SignedString(key) / Parse(token, keyFunc) pair with sane MapClaims defaults, while ParserOption functional options and the Keyfunc callback pattern (including VerificationKeySet for rotation) allow full customization. Doc comments proactively flag security footguns directly on exported functions - e.g. always validating alg and avoiding low-entropy HMAC secrets - which is a strong signal for a cryptography-adjacent library. The one notable friction point is a documented pointer/allocation caveat when embedding RegisteredClaims in custom claim types.