A simple library to encode and decode JSON Web Tokens (JWT) in PHP. Should conform to the current spec.

Installs: 155 052 868

Dependents: 1 424

Suggesters: 62

Security: 1

Stars: 8 263

Watchers: 245

Forks: 1 306

Open Issues: 80

v6.3.0 2022-07-15 16:48 UTC


Build Status Latest Stable Version Total Downloads License


A simple library to encode and decode JSON Web Tokens (JWT) in PHP, conforming to RFC 7519.


Use composer to manage your dependencies and download PHP-JWT:

composer require firebase/php-jwt

Optionally, install the paragonie/sodium_compat package from composer if your php is < 7.2 or does not have libsodium installed:

composer require paragonie/sodium_compat


use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$key = 'example_key';
$payload = [
    'iss' => '',
    'aud' => '',
    'iat' => 1356999524,
    'nbf' => 1357000000

 * You must specify supported algorithms for your application. See
 * for a list of spec-compliant algorithms.
$jwt = JWT::encode($payload, $key, 'HS256');
$decoded = JWT::decode($jwt, new Key($key, 'HS256'));


 NOTE: This will now be an object instead of an associative array. To get
 an associative array, you will need to cast it as such:

$decoded_array = (array) $decoded;

 * You can add a leeway to account for when there is a clock skew times between
 * the signing and verifying servers. It is recommended that this leeway should
 * not be bigger than a few minutes.
 * Source:
JWT::$leeway = 60; // $leeway in seconds
$decoded = JWT::decode($jwt, new Key($key, 'HS256'));

Example with RS256 (openssl)

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$privateKey = <<<EOD

$publicKey = <<<EOD
-----END PUBLIC KEY-----

$payload = [
    'iss' => '',
    'aud' => '',
    'iat' => 1356999524,
    'nbf' => 1357000000

$jwt = JWT::encode($payload, $privateKey, 'RS256');
echo "Encode:\n" . print_r($jwt, true) . "\n";

$decoded = JWT::decode($jwt, new Key($publicKey, 'RS256'));

 NOTE: This will now be an object instead of an associative array. To get
 an associative array, you will need to cast it as such:

$decoded_array = (array) $decoded;
echo "Decode:\n" . print_r($decoded_array, true) . "\n";

Example with a passphrase

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

// Your passphrase
$passphrase = '[YOUR_PASSPHRASE]';

// Your private key file with passphrase
// Can be generated with "ssh-keygen -t rsa -m pem"
$privateKeyFile = '/path/to/key-with-passphrase.pem';

// Create a private key of type "resource"
$privateKey = openssl_pkey_get_private(

$payload = [
    'iss' => '',
    'aud' => '',
    'iat' => 1356999524,
    'nbf' => 1357000000

$jwt = JWT::encode($payload, $privateKey, 'RS256');
echo "Encode:\n" . print_r($jwt, true) . "\n";

// Get public key from the private key, or pull from from a file.
$publicKey = openssl_pkey_get_details($privateKey)['key'];

$decoded = JWT::decode($jwt, new Key($publicKey, 'RS256'));
echo "Decode:\n" . print_r((array) $decoded, true) . "\n";

Example with EdDSA (libsodium and Ed25519 signature)

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

// Public and private keys are expected to be Base64 encoded. The last
// non-empty line is used so that keys can be generated with
// sodium_crypto_sign_keypair(). The secret keys generated by other tools may
// need to be adjusted to match the input expected by libsodium.

$keyPair = sodium_crypto_sign_keypair();

$privateKey = base64_encode(sodium_crypto_sign_secretkey($keyPair));

$publicKey = base64_encode(sodium_crypto_sign_publickey($keyPair));

$payload = [
    'iss' => '',
    'aud' => '',
    'iat' => 1356999524,
    'nbf' => 1357000000

$jwt = JWT::encode($payload, $privateKey, 'EdDSA');
echo "Encode:\n" . print_r($jwt, true) . "\n";

$decoded = JWT::decode($jwt, new Key($publicKey, 'EdDSA'));
echo "Decode:\n" . print_r((array) $decoded, true) . "\n";

Using JWKs

use Firebase\JWT\JWK;
use Firebase\JWT\JWT;

// Set of keys. The "keys" key is required. For example, the JSON response to
// this endpoint:
$jwks = ['keys' => []];

// JWK::parseKeySet($jwks) returns an associative array of **kid** to Firebase\JWT\Key
// objects. Pass this as the second parameter to JWT::decode.
JWT::decode($payload, JWK::parseKeySet($jwks));

Using Cached Key Sets

The CachedKeySet class can be used to fetch and cache JWKS (JSON Web Key Sets) from a public URI. This has the following advantages:

  1. The results are cached for performance.
  2. If an unrecognized key is requested, the cache is refreshed, to accomodate for key rotation.
  3. If rate limiting is enabled, the JWKS URI will not make more than 10 requests a second.
use Firebase\JWT\CachedKeySet;
use Firebase\JWT\JWT;

// The URI for the JWKS you wish to cache the results from
$jwksUri = '';

// Create an HTTP client (can be any PSR-7 compatible HTTP client)
$httpClient = new GuzzleHttp\Client();

// Create an HTTP request factory (can be any PSR-17 compatible HTTP request factory)
$httpFactory = new GuzzleHttp\Psr\HttpFactory();

// Create a cache item pool (can be any PSR-6 compatible cache item pool)
$cacheItemPool = Phpfastcache\CacheManager::getInstance('files');

$keySet = new CachedKeySet(
    null, // $expiresAfter int seconds to set the JWKS to expire
    true  // $rateLimit    true to enable rate limit of 10 RPS on lookup of invalid keys

$jwt = 'eyJhbGci...'; // Some JWT signed by a key from the $jwkUri above
$decoded = JWT::decode($jwt, $keySet);


Casting to array

The return value of JWT::decode is the generic PHP object stdClass. If you'd like to handle with arrays instead, you can do the following:

// return type is stdClass
$decoded = JWT::decode($payload, $keys);

// cast to array
$decoded = json_decode(json_encode($decoded), true);


6.3.0 / 2022-07-15

  • Added ES256 support to JWK parsing (#399)
  • Fixed potential caching error in CachedKeySet by caching jwks as strings (#435)

6.2.0 / 2022-05-14

  • Added CachedKeySet (#397)
  • Added $defaultAlg parameter to JWT::parseKey and JWT::parseKeySet (#426).

6.1.0 / 2022-03-23

  • Drop support for PHP 5.3, 5.4, 5.5, 5.6, and 7.0
  • Add parameter typing and return types where possible

6.0.0 / 2022-01-24

  • Backwards-Compatibility Breaking Changes: See the Release Notes for more information.
  • New Key object to prevent key/algorithm type confusion (#365)
  • Add JWK support (#273)
  • Add ES256 support (#256)
  • Add ES384 support (#324)
  • Add Ed25519 support (#343)

5.0.0 / 2017-06-26

4.0.0 / 2016-07-17

  • Add support for late static binding. See #88 for details. Thanks to @chappy84!
  • Use static $timestamp instead of time() to improve unit testing. See #93 for details. Thanks to @josephmcdermott!
  • Fixes to exceptions classes. See #81 for details. Thanks to @Maks3w!
  • Fixes to PHPDoc. See #76 for details. Thanks to @akeeman!

3.0.0 / 2015-07-22

  • Minimum PHP version updated from 5.2.0 to 5.3.0.
  • Add \Firebase\JWT namespace. See #59 for details. Thanks to @Dashron!
  • Require a non-empty key to decode and verify a JWT. See #60 for details. Thanks to @sjones608!
  • Cleaner documentation blocks in the code. See #62 for details. Thanks to @johanderuijter!

2.2.0 / 2015-06-22

  • Add support for adding custom, optional JWT headers to JWT::encode(). See #53 for details. Thanks to @mcocaro!

2.1.0 / 2015-05-20

  • Add support for adding a leeway to JWT:decode() that accounts for clock skew between signing and verifying entities. Thanks to @lcabral!
  • Add support for passing an object implementing the ArrayAccess interface for $keys argument in JWT::decode(). Thanks to @aztech-dev!

2.0.0 / 2015-04-01

  • Note: It is strongly recommended that you update to > v2.0.0 to address known security vulnerabilities in prior versions when both symmetric and asymmetric keys are used together.
  • Update signature for JWT::decode(...) to require an array of supported algorithms to use when verifying token signatures.


Run the tests using phpunit:

$ pear install PHPUnit
$ phpunit --configuration phpunit.xml.dist
PHPUnit 3.7.10 by Sebastian Bergmann.
Time: 0 seconds, Memory: 2.50Mb
OK (5 tests, 5 assertions)

New Lines in private keys

If your private key contains \n characters, be sure to wrap it in double quotes "" and not single quotes '' in order to properly interpret the escaped characters.


3-Clause BSD.