Firebase php-jwt

Firebase php-jwt is a small, focused PHP library for creating and verifying JSON Web Tokens (JWT). Its two core methods — JWT::encode() and JWT::decode() — sign and verify token payloads using a range of algorithms including HMAC (HS256/384/512), RSA (RS/PS), ECDSA (ES), and EdDSA, with a Key object binding each key material to its algorithm.

Beyond basic signing, it handles the practical concerns of real-world JWT verification: expiration (exp), not-before (nbf), and issued-at (iat) claim checks with configurable leeway, typed exceptions for each failure mode, and JWK support (JWK and CachedKeySet) for verifying tokens against remote JSON Web Key Sets such as those published by identity providers.

What You Get

• JWT::encode() and JWT::decode() for signing and verifying tokens
• Support for HMAC, RSA, ECDSA, and EdDSA signing algorithms
• A Key type that pairs key material with its algorithm to prevent algorithm confusion
• Automatic validation of exp, nbf, and iat claims with configurable leeway
• JWK parsing and a CachedKeySet for verifying tokens against remote JWKS endpoints

Common Use Cases

• Issuing and verifying stateless session or API access tokens
• Validating tokens issued by an OAuth/OIDC identity provider against its published JWKS
• Signing short-lived tokens for service-to-service authentication

Under The Hood

Architecture — The library is deliberately tiny: src/JWT.php holds the static encode/decode logic and the signing/verification dispatch across algorithm families; src/Key.php wraps key material with its algorithm; src/JWK.php parses JSON Web Key Sets into Key objects; and src/CachedKeySet.php fetches and caches remote JWKS via a PSR-6/PSR-16 cache and PSR-18 HTTP client. Failure modes are modeled as distinct exceptions — ExpiredException, BeforeValidException, SignatureInvalidException — several implementing JWTExceptionWithPayloadInterface so callers can inspect the decoded payload even on failure.

Tech Stack — Pure PHP ^8.0 with no required runtime dependencies; JWK caching optionally uses PSR HTTP/cache interfaces. It relies on PHP’s built-in openssl and hash_hmac for the cryptographic operations rather than bundling its own crypto.

Code Quality — For its size the test coverage is thorough: tests/ includes JWTTest, JWKTest, CachedKeySetTest, and even a ReadmeTest that executes the documentation examples to keep them correct. The single-responsibility file layout and typed exceptions make the behavior easy to reason about.

API Design — The surface is two static calls plus a Key value object, which is about as small as a JWT API can be. Binding algorithm to key at the Key level (rather than trusting the token header) is a deliberate security-oriented design choice, and the leeway parameter and headers argument cover the common real-world needs without expanding the API.