php-jwt

adhocore/jwt is a minimal, standalone JSON Web Token library for PHP that packs JWT encoding, decoding, and verification into a tiny, dependency-free codebase. It supports the common HMAC (HS256/384/512) and RSA (RS256/384/512) signing algorithms and validates the standard time-based claims out of the box.

With a single JWT class and a fluent, no-ceremony API, it aims to make issuing and verifying tokens trivial across PHP 5.6 through 8.4+, without pulling in a framework or heavyweight crypto stack.

What You Get

• A single Ahc\Jwt\JWT class with encode() and decode() covering the full token lifecycle
• HMAC (HS256/384/512) and RSA (RS256/384/512) signing algorithm support
• Standard claim validation for exp, iat, and nbf with configurable leeway and max-age
• Multiple keys resolved by kid header, plus passphrase support for encrypted RSA keys
• Dependency-free operation across PHP 5.6 to 8.4+ with a typed exception class

Common Use Cases

• Issuing signed access tokens for a stateless PHP API
• Verifying and decoding incoming bearer tokens in authentication middleware
• Rotating signing keys using the kid header to select among multiple keys
• Signing tokens with RSA private keys for asymmetric verification by clients

Under The Hood

Architecture - The package is deliberately tiny: src/JWT.php contains the whole implementation, backed by a ValidatesJWT trait that houses input and claim validation logic and a JWTException class for typed errors with numeric error codes. Signing dispatches on an internal algos map to either hash_hmac for HMAC variants or openssl_sign/openssl_verify for RSA, and decode() splits, base64url-decodes, and validates the header, payload, and signature segments.

Tech Stack - Pure PHP with PSR-4 autoloading under the Ahc\Jwt namespace, requiring only PHP ^7.0 || ^8.0 (and working back to 5.6). It leans on the built-in hash and openssl extensions for cryptography rather than any third-party library. PHPUnit is the sole dev dependency.

Code Quality - Files use declare(strict_types=1), errors are surfaced as coded JWTException instances rather than bare strings, and the repo ships a PHPUnit test suite (tests/JWTTest.php with stubs) plus CI, Scrutinizer, Codecov, and StyleCI badges indicating maintained quality gates.

API Design - The public surface is intentionally small and fluent: construct JWT with a key, algorithm, and options, then call encode()/decode(). Optional behavior (leeway, max-age, test timestamps, multiple keys) is set through setters, keeping the common path a two-line integration while still exposing the knobs advanced users need.