# auth0/express-jwt

connect/express middleware that validates a JsonWebToken (JWT) and set the req.user with the attributes

Repository: https://github.com/auth0/express-jwt
Canonical: https://ross.abutalabs.com/products/express-jwt
Language: TypeScript
License: MIT
License Family: permissive
Topics: express-jwt, jwt
Last push: 2026-06-25T15:22:02+00:00

## Health v2 (maintenance only)
Score: 72/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 89, release rhythm 35, longevity 100
- inputs: {"age_days": 4698, "days_push": 69, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4513, forks 443 (observed 2026-08-28T04:08:52.646221+00:00)

## What it is
Express middleware that validates JSON Web Tokens (JWTs) using the webtoken library and attaches the decoded payload to the request object. It supports custom token extraction, revocation checks, expiration handling, and configurable algorithms, audience, and issuer validation.

## Use cases
- protect express routes with jwt authentication
- validate bearer tokens in an express api
- attach decoded jwt payload to request object
- handle token revocation and expiration in express
- require authentication middleware for nodejs http endpoints

## When to choose
- you are building an express or connect-based nodejs api that authenticates users with jwts
- you need flexible token extraction from headers, cookies, or query params
- you want configurable validation of algorithms, audience, issuer, and revocation

## When to avoid
- you are not using express or connect middleware
- you need full oauth2/openid connect flows rather than simple jwt verification
- you use a framework other than express with incompatible middleware conventions

## Facets
- artifact type: library
- maturity: stable
- function: auth, middleware, http-server
- domain: security, web-development, backend, apis
- platform: -
- tags: jwt, express, authentication, bearer-token, token-validation, nodejs

## Member repositories
- auth0/express-jwt (main) score 72

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:52.646221+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:20:19.810076+00:00, confidence not recorded.
  - readme: https://github.com/auth0/express-jwt (fetched 2026-08-28T04:08:52.646221+00:00, sha 9168747a9b23)
  - registry_npm: https://registry.npmjs.org/express-jwt (fetched 2026-08-29T09:06:28.402106+00:00, sha 5cd2f9afd751)
- Data as of 2026-08-30T08:39:29.467469+00:00.