A pure-Go (no cgo) reimplementation of Ruby's
jwt gem (tracking release 3.2.0) — the
JSON Web Token library. It encodes and decodes JWS (JSON Web Signature)
compact-serialisation tokens byte-faithfully to the gem: given the same key,
algorithm, payload and header, the deterministic algorithms produce identical
tokens, and every algorithm cross-verifies with MRI in both directions —
without any Ruby runtime.
It is the JWT backend for go-embedded-ruby, but is a standalone, reusable module with no dependency on the Ruby runtime — a sibling of go-ruby-yaml (the Psych emitter/loader) and go-ruby-regexp (the Onigmo engine).
The whole surface is built on Go's standard crypto/* — crypto/hmac (HS),
crypto/rsa PKCS1v15 (RS) and PSS (PS), crypto/ecdsa (ES) — so it is CGO-free
and dependency-free:
- HS256 / HS384 / HS512 — HMAC
- RS256 / RS384 / RS512 — RSA PKCS#1 v1.5
- PS256 / PS384 / PS512 — RSA-PSS
- ES256 / ES384 / ES512 — ECDSA
- none — unsecured, per the JWA
nonealgorithm
Registered claim verification (exp, nbf, iat, iss, aud, sub, jti)
matches the gem's semantics, and JWK import/export is supported.
import "github.com/go-ruby-jwt/jwt"
tok, _ := jwt.Encode(map[string]any{"user": "amy", "exp": exp}, secret, "HS256", nil)
payload, header, _ := jwt.Decode(tok, secret, true, jwt.Options{
Algorithms: []string{"HS256"},
})go test ./... runs the unit and differential-oracle suites (cross-verified
against MRI's jwt gem). The CI gate enforces 100% statement coverage and
builds/tests on all six 64-bit Go targets — amd64, arm64, riscv64,
loong64, ppc64le, s390x.
BSD-3-Clause. Copyright (c) the go-ruby-jwt/jwt authors.
Being pure Go (CGO=0), this library also compiles to WebAssembly — both
GOOS=js GOARCH=wasm (browser / Node.js) and GOOS=wasip1 GOARCH=wasm (WASI).
CI builds both targets on every push, alongside the six 64-bit native/qemu arches.
GOOS=js GOARCH=wasm go build ./... # browser / Node
GOOS=wasip1 GOARCH=wasm go build ./... # WASI (wasmtime, wasmer, wasmedge, …)