PHP download

Download the PHP package swanflutter/native-jwt without Composer

On this page you can find all versions of the php package swanflutter/native-jwt. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

Table of contents
Download swanflutter/native-jwt
More information about swanflutter/native-jwt
Files in swanflutter/native-jwt

Vendor swanflutter
Package native-jwt
Short Description A PHP 8.1+ JWT library (HMAC, RSA, ECDSA, EdDSA, RSASSA-PSS) with JWK/JWKS support, PSR-6 cached key sets, and built-in algorithm-confusion and alg=none protection.
License MIT
Homepage https://github.com/swanflutter/native-jwt

Keywords auth standalone rsa token jwt hmac firebase ECDSA JWK FCM Ed25519 EdDSA JWKS rsa-pss

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:

If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.

Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
To use Composer is sometimes complicated. Especially for beginners.
Composer needs much resources. Sometimes they are not available on a simple webspace.
If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.

Please rate this library. Is it a good library?

Example code of swanflutter/native-jwt

Informations about the package native-jwt

swanflutter/native-jwt

A PHP 8.1+ JWT library with no mandatory runtime dependencies.

It relies only on PHP's bundled extensions (openssl, hash, json) for the core algorithms, and adds optional support for EdDSA (libsodium), RSA JWK parsing (GMP), and remote JWKS caching (PSR-18 / PSR-17 / PSR-6).

Drop-in replacement for firebase/php-jwt's JWT::encode() / JWT::decode() API, with full feature parity.

Supported algorithms

Family	Algorithms	Requires
HMAC (symmetric)	`HS256`, `HS384`, `HS512`	built-in
RSA PKCS#1 v1.5	`RS256`, `RS384`, `RS512`	`ext-openssl`
RSA-PSS	`PS256`, `PS384`, `PS512`	`ext-openssl`
ECDSA	`ES256`, `ES384`, `ES512`	`ext-openssl`
EdDSA (Ed25519)	`EdDSA`	`ext-sodium`

Security

alg: none is explicitly rejected.
Algorithm-confusion is prevented: every trusted key is bound to a single algorithm via the Key object.
HMAC and EdDSA signatures are compared in constant time.
exp / nbf / iat claims are validated with configurable leeway.
ECDSA signatures are correctly converted between OpenSSL's DER format and the R||S concatenation required by the JWT spec.
RSASSA-PSS is implemented with RFC 8017-compliant EMSA-PSS encoding (salt length = hash length, MGF1).

Installation

Optional extras:

Usage

HMAC (symmetric)

RSA / ECDSA (asymmetric)

RSASSA-PSS (PS256 / PS384 / PS512)

EdDSA (Ed25519)

Multiple keys by `kid`

Clock skew / leeway

JWK / JWKS

Parse a static JWKS document

Supported key types:

`kty`	Curves / algorithms
`RSA`	RS256, RS384, RS512, PS256, PS384, PS512
`EC`	P-256 (ES256), P-384 (ES384), P-521 (ES512)
`OKP`	Ed25519 (EdDSA)

RSA JWK parsing requires ext-gmp.

CachedKeySet — remote JWKS with PSR-6 cache

CachedKeySet automatically refreshes the cache once when an unknown kid is encountered, which supports key rotation without manual intervention.

Example with Guzzle + Symfony Cache:

Firebase FCM HTTP v1 — access token

Firebase FCM HTTP v1 requires a short-lived OAuth 2.0 access token signed with a Google service account key. The service account JSON contains an RSA private key (RS256).

Exception hierarchy

All exceptions extend SwanFlutter\NativeJwt\Exceptions\JWTException:

Exception	Cause
`ExpiredException`	`exp` claim exceeded
`BeforeValidException`	`nbf` or `iat` is in the future
`SignatureInvalidException`	bad signature, disallowed algorithm, algorithm mismatch
`InvalidTokenException`	malformed token, missing claims, bad Base64

Generating keys

Testing

License

MIT

All versions of native-jwt with dependencies

PHP Build Version

Package Version

Version v1.2.0 Release 16. Jul 2026
create-project require 0 people chose require and
0 people chose create-project.

Download

Download latest version of native-jwt from vendor swanflutter

Requires php Version ^8.1
ext-json Version *
ext-openssl Version *
ext-hash Version *

Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package swanflutter/native-jwt contains the following files

Loading the files please wait ...