Repo brief: jwt/ruby-jwt

Generated by RepoPilot · document generated 2026-09-15 · concise human review Evidence snapshot · analyzed 2026-09-15T06:58:48.870Z · commit 6cdacc377788

Verdict

Healthy — Strong maintenance signals

• Last commit 1d ago
• 12 active contributors
• MIT licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

ruby-jwt is a pure Ruby implementation of the RFC 7519 JSON Web Token (JWT) standard, enabling secure token-based authentication and claim verification. It natively supports NONE, HMAC, RSASSA, ECDSA, and RSASSA-PSS signing algorithms via OpenSSL, with pluggable extension support for additional algorithms like EdDSA. The library handles both token encoding (with custom claims and expiration) and decoding (with automatic algorithm and claim validation). Modular single-library architecture: lib/jwt/ contains the main entry point (jwt.rb) with subsystems for base64 encoding (base64.rb), claims validation (claims/), algorithm implementations (jwa/ supporting HMAC, RSA, ECDSA, PS, NONE), JWK…

Start here

Open these first:

• lib/jwt.rb — Main entry point exposing JWT.encode and JWT.decode methods; all public API flows begin here.
• lib/jwt/encode.rb — Core encoding logic that serializes claims and applies cryptographic signing; handles payload transformation.
• lib/jwt/decode.rb — Core decoding logic that verifies signatures, validates claims, and deserializes payloads; critical for security.
• lib/jwt/jwa.rb — JSON Web Algorithms registry and dispatcher; routes signing/verification to algorithm-specific implementations.
• lib/jwt/claims/verifier.rb — Orchestrates all claim validation (expiration, audience, issuer, etc.); enforces RFC 7519 compliance.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone the repository: git clone https://github.com/jwt/ruby-jwt.git && cd ruby-jwt. Install dependencies using Bundler (Gemfile is present): bundle install. Require the gem in your Ruby application: require 'jwt'.…

Daily commands:

This is a library, not an executable application. To test the library locally, run the test suite (command not explicitly visible, but standard: bundle exec rake test or bundle exec rspec — verify in Rakefile or spe…

…shortened for this brief.

Key cautions & unknowns

• Concentrated ownership — top contributor handles 67% of recent commits
• Critical: users must always pass algorithm as a string to JWT.decode() to prevent algorithm substitution attacks (README explicitly warns this). The gem provides no built-in HTTP client for JWK Set fetching; users must…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.