jsonwebtoken is a Node.js implementation for creating and verifying JSON Web Tokens (JWTs). It provides functions like jwt.sign and jwt.verify, useful for signing payloads with HMAC or RSA/ECDSA keys and validating token signatures and optional claims such as expiration, audience, or issuer.
Project status
- Maintenance status: Evidence suggests the project is still being worked on (latest upstream push on 2026-06-25), but published updates are infrequent.
- Update cadence: The most recent tagged update is v9.0.3 on 2025-12-04, with prior tagged updates in 2023 (v9.0.2 on 2023-08-30, v9.0.1 on 2023-07-05), indicating a long, irregular release cadence with intermittent bursts of activity.
AI summary generated
Recent updates
v9.0.3
v9.0.3 changes the project mainly in build and developer workflow configuration, and updates the runtime dependency on jws. The provided release notes section is empty, so most of what changed is not explicitly documented there, aside from what appears in CHANGELOG.md.
v9.0.2
No release notes were provided for v9.0.2 in the release description. The code diff shows the version was bumped to 9.0.2 and introduces dependency changes focused on a security patch (semver) and a refactor to reduce lodash bundle size by switching to lodash-specific submodules.
Securityv9.0.1
Release v9.0.1 was published on 2023-07-05, but no release notes were provided by the publisher. As a result, no documented changes (features, fixes, or breaking behavior) can be extracted from the release notes content.
v9.0.0
The v9.0.0 release focuses on security hardening and stricter validation, including dropping support for Node 11 and below and tightening verification behavior around unsigned tokens and key material. The diff shows substantial internal changes, especially in signing and asymmetric key validation, and it adds newer key-related configuration options.
BreakingSecurityFeaturesv8.5.1
Release v8.5.1 includes a small set of changes: a patch dependency bump and updates to documentation/changelog text. The only functional signal in the diff is a fix related to RSA-PSS (PS) signing and verification, implied by the changelog entry, plus a README correction around algorithm table wording.
v8.5.0
No release notes were provided by the publisher for v8.5.0. The code diff from v8.4.0 to v8.5.0 shows new support for PS-based JWA algorithms (PS256/PS384/PS512) on supported Node versions, adds a new `complete` mode to `jwt.verify`, and changes how the `iat` claim is handled for non-object (string) payloads.
Featuresv8.4.0
Release v8.4.0 (no publisher release notes provided) changes sign-time claim parsing for `expiresIn` and `notBefore`, and significantly updates the repo tooling and test suite. The diff also updates the package engines requirement and modernizes several dev dependencies, which can impact consumers of the library and CI environments.
v8.3.0
v8.3.0 includes documentation updates and CI/config cleanups, plus a “secret callback revisited” change intended to improve how jwt.verify can retrieve the secret or public key dynamically. The code diff shows a substantial refactor in verify.js to support secretOrPublicKey as a callback function and introduces new validation and error-wrapping behavior.
Featuresv8.2.2
v8.2.2 contains a dependency bump (jws 3.1.5) and several documentation and CI maintenance changes. No application/library source code diffs (only README, CHANGELOG, package.json, and .travis.yml) are present in the provided diff.
Securityv8.2.1
The publisher provided no release notes for v8.2.1, so there is no documented information about added features, bug fixes, breaking changes, or other developer-impacting changes. Without release notes (and without code diff context), this version should be treated as unknown impact for upgrade planning.