public final class Jwt

JSON Web Token (RFC 7519) signing and verification.

Supported algorithms:

• HS256, HS384, HS512 – HMAC with SHA-2. Pure Java, available on every platform.
• RS256, RS384, RS512 – RSA-PKCS1-v1_5 with SHA-2. Backed by the platform’s native crypto via Signature.
• ES256, ES384, ES512 – ECDSA with SHA-2. Backed by the platform’s native crypto via Signature.
• none – unsigned tokens. Accepted on the signing side only when caller explicitly passes it; rejected on verification unless caller opts in via verifyAllowNoneAlgorithm.

Sign a token

Map<String, Object> claims = new HashMap<String, Object>();
claims.put("sub", "user-123");
claims.put("exp", System.currentTimeMillis() / 1000 + 3600);

String token = Jwt.signHs256(claims, "secret".getBytes("UTF-8"));

Verify and read claims

Jwt parsed = Jwt.parse(token);
if (!parsed.verifyHs256("secret".getBytes("UTF-8"))) {
    throw new SecurityException("bad signature");
}
String sub = (String) parsed.getClaim("sub");