This is an implementation of JWT in golang!
Latest commit 90c0198 Oct 4, 2016 @robbert229 committed on GitHub Merge pull request #9 from robbert229/robbert229-add-note
Add note to differentiate from

Build Status Coverage Status Go Report Card GoDoc


This is a minimal implementation of JWT designed with simplicity in mind.

What is JWT?

Jwt is a signed JSON object used for claims based authentication. A good resource on what JWT Tokens are is, and in addition you can always read the RFC.

This implementation doesn't fully follow the specs in that it ignores the algorithm claim on the header. It does this due to the security vulnerability in the JWT specs. Details on the vulnerability can be found here

What algorithms does it support?

  • HS256
  • HS384
  • HS512

How does it work?

How to create a token?

Creating a token is actually pretty easy.

The first step is to pick a signing method. For demonstration purposes we will choose HSMAC256.

algorithm :=  jwt.HmacSha256("ThisIsTheSecret")

Now we need to the claims, and edit some values

claims := jwt.NewClaim()
claims.Set("Role", "Admin)

Then we will need to sign it!

token, err := algorithm.Encode(claims)
if err != nil {

How to authenticate a token?

Authenticating a token is quite simple. All we need to do is...

if algorithm.Validate(token) == nil {

How do we get the claims?

The claims are stored in a Claims struct. To get the claims from a token simply...

claims, err := algorithm.Decode(token)
if err != nil {
_, role := claims.Get("Role")
if strings.Compare(role, "Admin") {
    //user is an admin    

How is it different from

This package contains just the logic for jwt encoding, decoding, and verification. The package does not implement the jwt specifications. Instead it is specifically tied to oauth2, requiring a TokenURL, email and can only use a specific algorithm (RSA).