Skip to content

JWT Framework

Welcome to the JWT Framework documentation. This is a modern, secure, and comprehensive PHP library for working with JSON Web Tokens (JWT), designed for both standalone applications and Symfony projects.

What is JWT Framework?

JWT Framework is a complete implementation of the JOSE (JSON Object Signing and Encryption) specifications, providing robust tools for creating, signing, encrypting, and validating JSON Web Tokens. It follows industry standards and security best practices to help you implement secure token-based authentication and data exchange in your applications.

Supported standards

This framework provides full implementation of the following RFCs:

Key features

🔐 comprehensive security

  • Support for all standard signature algorithms (HMAC, RSA, ECDSA, EdDSA)
  • Support for all standard encryption algorithms (AES-GCM, AES-CBC, RSA-OAEP, ECDH-ES)
  • Built-in header and claim validation
  • Protection against common JWT vulnerabilities

🛠️ flexible integration

  • Standalone library - Use it in any PHP project
  • Symfony Bundle - Seamless integration with Symfony applications
  • Console commands - CLI tools for key management and token inspection

🚀 developer friendly

  • Fluent API for building and loading tokens
  • Factory pattern for creating services
  • PSR-20 Clock support for time-based validation
  • Comprehensive error handling

📦 production ready

  • Extensively tested against RFC test vectors
  • Support for nested tokens (signed then encrypted)
  • Multiple serialization formats (Compact, JSON Flattened, JSON General)
  • Key set management for key rotation

Installation

Install the package that matches your project:

# Any PHP project — the core library
composer require web-token/jwt-library

# Symfony application — the bundle (pulls the library in)
composer require web-token/jwt-bundle

For Symfony projects, the bundle is automatically registered.

Quick start

use Jose\Component\Core\AlgorithmManager;
use Jose\Component\Core\JWK;
use Jose\Component\Signature\Algorithm\HS256;
use Jose\Component\Signature\JWSBuilder;
use Jose\Component\Signature\Serializer\CompactSerializer;

// Create an algorithm manager
$algorithmManager = new AlgorithmManager([new HS256()]);

// Create a JWS Builder
$jwsBuilder = new JWSBuilder($algorithmManager);

// Create a key
$jwk = new JWK([
    'kty' => 'oct',
    'k' => 'your-secret-key-here',
]);

// Build and sign your token
$jws = $jwsBuilder
    ->withPayload(json_encode(['user_id' => 123]))
    ->addSignature($jwk, ['alg' => 'HS256'])
    ->build();

// Serialize to compact format
$serializer = new CompactSerializer();
$token = $serializer->serialize($jws, 0);

Documentation structure

This documentation is organized to help you get started quickly and dive deep when needed:

Requirements

  • PHP 8.2 or higher
  • OpenSSL extension
  • Recommended: GMP or BCMath for better performance
  • Recommended: Sodium extension for the Ed25519 and X25519 curves (PHP 8.4 can use OpenSSL instead; the Ed448 and X448 curves need PHP 8.4)

Get help

Contributing

Contributions are welcome! Please read the contributing guidelines before submitting pull requests.

License

This project is released under the MIT license.