PHP-JWT

To use the PS256 algorithm, you must install phpseclib/phpseclib:^3.0 via Composer, as PHP's OpenSSL extension does not support RSASSA-PSS by default.

composer install phpseclib/phpseclib:^3.0

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$jwt = JWT::encode($payload, $privateRsKey, 'PS256', 'keyid');
$decoded = JWT::decode($jwt, new Key($publicKey, 'PS256'));

This library does not support decoding headers without verification because unverified headers can be tampered with. If you must access header values without validation, you must manually decode the first part of the JWT string using base64_decode and json_decode. Warning: This is vulnerable to attacks if the data is used for security decisions.

use Firebase\JWT\JWT;

$jwt = '...'; // Your JWT string

// Manually decode the header part
list($headersB64, $payloadB64, $sig) = explode('.', $jwt);
$decoded = json_decode(base64_decode($headersB64), true);

print_r($decoded);

Use Composer to install the PHP-JWT library. If your PHP environment does not have libsodium installed, you should also install paragonie/sodium_compat to ensure support for algorithms like EdDSA.

composer require firebase/php-jwt

# Optional: install if libsodium is missing
composer require paragonie/sodium_compat

If your tokens use different Key IDs (kid), you can pass an associative array of Firebase\JWT\Key objects to JWT::decode(). The array keys should match the kid in the JWT header.

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$payload = ['iss' => 'example.org'];

// Encode with specific Key IDs
$jwt1 = JWT::encode($payload, $privateRsKey, 'RS256', 'kid1');
$jwt2 = JWT::encode($payload, $privateEcKey, 'EdDSA', 'kid2');

// Provide a map of keys for decoding
$keys = [
    'kid1' => new Key($publicRsKey, 'RS256'),
    'kid2' => new Key($publicEcKey, 'EdDSA'),
];

$decoded1 = JWT::decode($jwt1, $keys);
$decoded2 = JWT::decode($jwt2, $keys);

For RSA signatures, use JWT::encode() with a private key and JWT::decode() with a Key object containing the public key.

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$privateKey = '-----BEGIN RSA PRIVATE KEY----- ...';
$publicKey = '-----BEGIN PUBLIC KEY----- ...';

$payload = [
    'iss' => 'example.org',
    'aud' => 'example.com',
    'iat' => 1356999524,
    'nbf' => 1357000000
];

$jwt = JWT::encode($payload, $privateKey, 'RS256');
$decoded = JWT::decode($jwt, new Key($publicKey, 'RS256'));
$decoded_array = (array) $decoded;

Use JWT::encode() to create a token and JWT::decode() to verify and parse it. When decoding, you must provide a Firebase\JWT\Key object specifying the key and the algorithm. By default, JWT::decode() returns a stdClass object; cast it to (array) if you require an associative array. You can also set JWT::$leeway to account for clock skew between servers.

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$key = 'example_key_of_sufficient_length';
$payload = [
    'iss' => 'example.org',
    'aud' => 'example.com',
    'iat' => 1356999524,
    'nbf' => 1357000000
];

// Encode
$jwt = JWT::encode($payload, $key, 'HS256');

// Decode
$decoded = JWT::decode($jwt, new Key($key, 'HS256'));

// To get an associative array:
$decoded_array = (array) $decoded;

// Account for clock skew (e.g., 60 seconds)
JWT::$leeway = 60;
$decoded = JWT::decode($jwt, new Key($key, 'HS256'));

EdDSA requires libsodium. Keys are expected to be Base64 encoded. Use sodium_crypto_sign_keypair() to generate keys for testing.

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$keyPair = sodium_crypto_sign_keypair();
$privateKey = base64_encode(sodium_crypto_sign_secretkey($keyPair));
$publicKey = base64_encode(sodium_crypto_sign_publickey($keyPair));

$payload = [
    'iss' => 'example.org',
    'aud' => 'example.com',
    'iat' => 1356999524,
    'nbf' => 1357000000
];

$jwt = JWT::encode($payload, $privateKey, 'EdDSA');
$decoded = JWT::decode($jwt, new Key($publicKey, 'EdDSA'));
$decoded_array = (array) $decoded;

The JWT::decode method returns a stdClass object. If your application requires the decoded payload as an associative array, you can cast it using json_decode and json_encode.

// return type is stdClass
$decoded = JWT::decode($jwt, $keys);

// cast to array
$decoded = json_decode(json_encode($decoded), true);

You can use Firebase\JWT\JWK::parseKeySet($jwks) to convert a JSON Web Key Set (JWKS) into an associative array of Firebase\JWT\Key objects. This array can then be passed directly to JWT::decode().

use Firebase\JWT\JWK;
use Firebase\JWT\JWT;

// $jwks is an associative array containing a 'keys' element
$jwks = ['keys' => []];

// Parse the JWKS and decode the token
$decoded = JWT::decode($jwt, JWK::parseKeySet($jwks));