🥮 mooncakes.io

    mb-jwt

    JWT (JSON Web Tokens) for MoonBit with HS256 signing and verification

    crypto
    jwt
    token
    hs256
    json-web-token
    Download zip
    Author
    Version
    0.1.0
    License
    Apache-2.0
    Repository
    Last updated
    6 months ago
    Downloads
    93

    #mb-jwt

    JWT (JSON Web Tokens) implementation for MoonBit with HS256 signing.

    #Status

    In Development - Implements HS256 algorithm (HMAC-SHA256).

    #Installation

    Add to your moon.mod.json:

    {
  "deps": {
    "moon-crypto/mb-jwt": "0.1.0"
  }
}

    #Usage

    #Sign a token

    let payload = "{\"sub\":\"1234567890\",\"name\":\"John Doe\"}"
    let secret = "your-secret-key"

    let token = @jwt.sign(payload, secret)
    // Returns: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOi...

    #Verify a token

    match @jwt.verify(token, secret) {
      Ok(payload) => println("Valid! Payload: " + payload)
      Err(e) => println("Invalid: " + e)
    }

    #Decode without verification

    // WARNING: Never trust unverified tokens
    match @jwt.decode(token) {
      Ok(payload) => println(payload)
      Err(e) => println("Malformed token")
    }

    #API

    FunctionDescription
    sign(payload: String, secret: String) -> StringCreate a signed JWT
    verify(token: String, secret: String) -> Result[String, String]Verify and decode a JWT
    decode(token: String) -> Result[String, String]Decode without verification
    decode_header(token: String) -> Result[String, String]Decode the JWT header

    #Supported Algorithms

    • HS256 - HMAC with SHA-256 (default, currently only supported)

    #Security Notes

    • Uses constant-time comparison for signature verification
    • Always verify tokens before trusting their contents
    • Use strong, random secrets (at least 256 bits)

    #Dependencies

    • mb-hmac - HMAC-SHA256 implementation

    base64url_decode

    source
    fn base64url_decode(encoded : String) -> Array[UInt]

    base64url_decode_to_string

    source
    fn base64url_decode_to_string(encoded : String) -> String

    base64url_encode

    source
    fn base64url_encode(data : Array[UInt]) -> String

    base64url_encode_string

    source
    fn base64url_encode_string(s : String) -> String

    decode

    source
    fn decode(token : String) -> Result[String, String]
    Decodes a JWT token without verifying the signature. Use this only when you need to inspect the payload without verification. WARNING: Never trust the contents of an unverified token.

    decode_header

    source
    fn decode_header(token : String) -> Result[String, String]
    Decodes the header of a JWT token without verification.

    sign

    source
    fn sign(payload : String, secret : String) -> String
    Signs a JSON payload and returns a JWT token string. The payload should be a valid JSON string.

    Example:
    let token = sign("{\"sub\":\"1234567890\",\"name\":\"John\"}", "secret")

    verify

    source
    fn verify(token : String, secret : String) -> Result[String, String]
    Verifies a JWT token and returns the decoded payload if valid. Returns an error if the signature is invalid or the token is malformed.

    Source Files

    Powered by MoonBit

    Site sourceReport issueModulesSkillsCLIBuild queueStatistics

    © 2026 mooncakes.io