node-jsonwebtoken

jsonwebtoken is a widely used Node.js implementation of JSON Web Tokens (RFC 7519) developed by Auth0. It enables secure token-based authentication and authorization in Node.js applications. Key capabilities: - **Token signing (jwt.sign)**: Create JWTs with payload claims (exp, nbf, aud, iss, sub, jti, iat) using symmetric (HMAC) or asymmetric (RSA, ECDSA, RSA-PSS) algorithms. Supports synchronous and asynchronous operation. Options include algorithm selection (default HS256), expiration times (expiresIn, notBefore), custom headers, key IDs, and insecure key size allowances for legacy RSA keys. - **Token verification (jwt.verify)**: Validate token signatures and claims. Accepts secrets, PEM public keys, or a key-fetching callback (useful with JWKS endpoints). Validates algorithms, audience, issuer, JWT ID, subject, expiration (with clockTolerance), not-before, and maximum token age. Returns decoded payload or full token object (header, payload, signature) when complete option is set. - **Token decoding (jwt.decode)**: Inspect token payload and header without signature verification (not for untrusted input). - **Supported algorithms**: HS256, HS384, HS512 (HMAC); RS256, RS384, RS512 (RSASSA-PKCS1-v1_5); PS256, PS384, PS512 (RSASSA-PSS, Node ≥6.12.0/≥8.0.0); ES256, ES384, ES512 (ECDSA); and "none" (unsecured). - **Error handling**: Distinct error types (TokenExpiredError, JsonWebTokenError, NotBeforeError) with detailed properties for programmatic handling. - **Security notes**: Minimum 2048-bit RSA modulus enforced by default; base64-encoded secrets supported via Buffer.from; payloads from untrusted sources should be sanitized. The library is MIT licensed, maintained by Auth0, and integrates with key management solutions like node-jwks-rsa for rotating keys. Migration guides exist for major version upgrades.