# mikenicholson/passport-jwt

Passport authentication using JSON Web Tokens

Repository: https://github.com/mikenicholson/passport-jwt
Canonical: https://ross.abutalabs.com/products/passport-jwt
Language: JavaScript
License: MIT
License Family: permissive
Last push: 2024-02-03T20:10:41+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 4316, "days_push": 942, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1980, forks 210 (observed 2026-08-28T04:06:01.661886+00:00)

## What it is
passport-jwt is a Passport authentication strategy for Node.js that authenticates HTTP requests using JSON Web Tokens. It extracts a JWT from incoming requests, verifies its signature and optional claims (issuer, audience, expiration, algorithms), and enables session-less token-based authentication for RESTful API endpoints.

## Use cases
- authenticate a node.js express API with JWT bearer tokens
- add JSON Web Token authentication to a Passport-based app
- secure RESTful endpoints without server-side sessions
- verify JWT signature from the Authorization header in Node.js
- token-based stateless authentication for a REST API
- passport strategy that validates JWT issuer, audience, and expiration
- extract and verify a JWT from a request using a custom extractor

## When to choose
- Your Node.js app already uses Passport and you want to add JWT-based, session-less authentication
- You need to secure RESTful API endpoints with signed tokens using either symmetric secrets or PEM-encoded public keys
- You need flexible token extraction from headers, query strings, cookies, or body, or per-request secret resolution via secretOrKeyProvider

## When to avoid
- You are not using Passport and just need standalone JWT verification (use jsonwebtoken or a simple middleware directly)
- You need browser login flows with sessions, OAuth, or OpenID Connect (other Passport strategies or an identity provider SDK fit better)
- You require built-in JWKS key-rotation support from an identity provider without writing a custom secretOrKeyProvider

## Facets
- artifact type: library
- maturity: active
- function: auth, middleware
- domain: security, web-development, backend, apis
- platform: -
- tags: jwt, passport, passport-strategy, json-web-tokens, token-authentication, stateless-auth, rest-api, express, npm-package, nodejs, web-server

## Member repositories
- mikenicholson/passport-jwt (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:01.661886+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:04:39.625876+00:00, confidence not recorded.
  - readme: https://github.com/mikenicholson/passport-jwt (fetched 2026-08-28T04:06:01.661886+00:00, sha af9bf6b3ab2a)
  - registry_npm: https://registry.npmjs.org/passport-jwt (fetched 2026-08-29T10:43:51.973095+00:00, sha c1faffbd80c3)
- Data as of 2026-08-30T08:39:29.467469+00:00.