lestrrat-go/jwx

Health v2 · maintenance only

Adoption not part of the score

2416 stars · 196 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A comprehensive Go library implementing the full JOSE family of standards (JWA, JWE, JWK, JWS, JWT) for signing, verifying, encrypting, and decrypting tokens and messages. It offers a uniform API, JWK caching via an extension module, and post-quantum algorithm support including ML-KEM, ML-DSA, and HPKE.

Use cases

• sign and verify JWTs in a Go service
• parse and validate OIDC ID tokens
• encrypt payloads with JWE
• fetch and cache JWKS keys from an identity provider
• sign messages with multiple signatures using JWS
• try post-quantum signing algorithms like ML-DSA

When to choose

• you need complete JOSE coverage in Go, not just basic JWT handling
• you need JWS detached payloads, RFC 7797, or multi-recipient JWE
• you want a consistent, option-based API across all JWx operations
• you need post-quantum cryptography support

When to avoid

• you only need minimal JWT signing and a smaller dependency suffices
• you are not using Go
• you cannot run Go 1.26+ or manage the GOEXPERIMENT=jsonv2 requirement on Go 1.26
• you need a batteries-included auth server rather than a token library

Facets

library · maturity active

cryptography auth serialization security security developer-tools apis web-development go cross-platform jwt jws jwe jwk jose oidc post-quantum-cryptography token-signing

Member repositories

For agents

markdown · JSON · MCP: product_card(name="lestrrat-go/jwx")