Skip to content
Get packs

jwt-go

Go library for creating, signing, and verifying JSON Web Tokens. Archived; use golang-jwt/jwt instead.

GitHub Download source
Stars
10.7k
Forks
971
Licence
MIT
Language
Go
Last update
5.0 years ago
Type
Library

This repository is archived and no longer maintained.

What it is

This is a Go code library for working with JSON Web Tokens (JWTs), small signed JSON objects often used to prove a user's identity in web services. It can create and sign tokens, and parse and verify them. The repository is archived and the README says it is no longer maintained, pointing to golang-jwt/jwt as the successor.

  • Create a signed token containing user claims using HMAC, RSA, RSA-PSS, or ECDSA signing
  • Parse and verify an incoming token's signature and claims in a Go web service
  • Add a custom signing method by implementing the SigningMethod interface and registering it

Great for

  • Go developers maintaining an existing project that already depends on this library
  • Teams that need to pin an older dependency version while planning a migration
  • Developers reading older code or examples that use this import path

Not ideal for

  • New projects: the README says the repository is no longer maintained, so use the successor golang-jwt/jwt instead
  • Anyone needing encryption of token contents, since the README notes JWT does not encrypt data and JWE is outside this library's scope
  • Non-Go developers, since this is a Go-only library

How to get it

  1. 1

    Install with a package manager

    You'll need: Go

    Clone the repository

    git clone https://github.com/dgrijalva/jwt-go
  2. 2

    Run it

    • Read the README note pointing to golang-jwt/jwt, the replacement repository
    • Choose a signing method (symmetric HMAC or asymmetric RSA/ECDSA) based on who needs to verify tokens
    • Review the linked godoc examples for parsing and building tokens
    • Always check that the alg in a token matches the one you expect
  3. 3

    Get the most out of it

    • Read the README security notices: validate the alg presented matches what you expect, and upgrade Go to at least 1.8.3
    • Pin to version 3 in your dependency manager if you depend on this library and want to avoid interruptions, as the README suggests
    • Use the gopkg.in/dgrijalva/jwt-go.v3 alternative import path for semantic-versioning-safe updates, per the README
    • Review MIGRATION_GUIDE.md and VERSION_HISTORY.md if upgrading across major versions

Downloads

Source code (.zip)master branch · straight from GitHubOfficial website & docsgithub.com/golang-jwt/jwt

Strengths

  • Supports several common signing algorithms: HMAC SHA, RSA, RSA-PSS, and ECDSA
  • Widely used, with about 10,700 GitHub stars at the time of this metadata
  • Released under the permissive MIT license

Trade-offs

  • Archived and no longer maintained, so it will not receive fixes or updates from this repository
  • The README includes security notices requiring Go upgrades and careful checking of the alg header
  • Requires understanding of signing methods and key types to use safely

Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.