jsonwebtoken vs passport vs @nestjs/passport vs express-jwt | Authentication and Authorization in Node.js

Package	Downloads	Stars	Size	Issues	Publish	License

jsonwebtoken	27,220,035	18,116	43.4 kB	185	4 days ago	MIT
passport	4,914,521	23,468	157 kB	393	2 years ago	MIT
@nestjs/passport	1,973,248	545	22.8 kB	10	a year ago	MIT
express-jwt	616,989	4,515	28.5 kB	64	a year ago	MIT

Integration with Frameworks

jsonwebtoken:
jsonwebtoken is a standalone library that works with any Node.js application. It does not depend on any framework, making it versatile for use in both Express and non-Express applications. However, it does not provide any built-in middleware or integration features.
passport:
passport is a middleware for Express and Connect applications, but it is not tied to any specific framework. It provides a wide range of authentication strategies that can be integrated into any Express app, but it requires additional setup and configuration.
@nestjs/passport:
@nestjs/passport is specifically designed for NestJS, leveraging its dependency injection and modular architecture. It provides decorators and guards that align with NestJS's design principles, making it easy to implement authentication in a structured way.
express-jwt:
express-jwt is a middleware for Express applications, but it does not provide any framework-specific features. It can be easily integrated into any Express app to protect routes by validating JWTs, but it requires manual setup and configuration.

Token Handling

jsonwebtoken:
jsonwebtoken provides comprehensive functionality for creating, signing, and verifying JWTs. It allows you to generate tokens with custom payloads, set expiration times, and validate tokens using secret keys or public/private key pairs.
passport:
passport is agnostic to token handling and does not provide any built-in functionality for creating or validating tokens. It relies on external libraries (like jsonwebtoken) to handle token operations, especially when using token-based authentication strategies.
@nestjs/passport:
@nestjs/passport does not handle token creation or validation directly, as it focuses on integrating Passport.js with NestJS. Token handling is typically done using jsonwebtoken or similar libraries in conjunction with Passport strategies.
express-jwt:
express-jwt focuses solely on validating JWTs in incoming requests. It does not handle token creation or signing, so you will need to use a separate library like jsonwebtoken for that purpose.

Flexibility and Customization

jsonwebtoken:
jsonwebtoken provides flexibility in how you create and verify tokens, including support for different signing algorithms and custom payloads. However, it is a low-level library that requires you to implement your own logic for handling tokens in your application.
passport:
passport is highly flexible and customizable, allowing you to implement multiple authentication strategies (e.g., local, OAuth, JWT) within the same application. It supports custom strategy implementations, making it easy to integrate third-party authentication providers.
@nestjs/passport:
@nestjs/passport offers flexibility in integrating various Passport strategies within a NestJS application. However, the customization is primarily around how strategies are implemented and used within the NestJS framework.
express-jwt:
express-jwt is flexible in that it allows you to customize the JWT validation process, including providing your own token extraction logic and error handling. However, it is focused solely on JWTs and does not support other authentication methods.

Ease of Use: Code Examples

jsonwebtoken:

JSON Web Token Example

const jwt = require('jsonwebtoken');
const secret = 'your_jwt_secret';

// Create a token
const token = jwt.sign({ userId: 1 }, secret, { expiresIn: '1h' });
console.log('Generated Token:', token);

// Verify the token
jwt.verify(token, secret, (err, decoded) => {
  if (err) {
    console.error('Token verification failed:', err);
  } else {
    console.log('Decoded Token:', decoded);
  }
});

passport:

Passport Authentication Example

const express = require('express');
const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;

const app = express();
app.use(passport.initialize());

// Configure local strategy
passport.use(new LocalStrategy((username, password, done) => {
  // Authenticate user (replace with your logic)
  if (username === 'user' && password === 'pass') {
    return done(null, { id: 1, username });
  }
  return done(null, false);
}));

// Login route
app.post('/login', passport.authenticate('local'), (req, res) => {
  res.send('Logged in');
});

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

@nestjs/passport:

NestJS Passport Example

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Controller('profile')
export class ProfileController {
  @Get()
  @UseGuards(AuthGuard('jwt'))
  getProfile() {
    return { message: 'This is a protected route';
  }
}

express-jwt:

Express JWT Example

const express = require('express');
const jwt = require('jsonwebtoken');
const expressJwt = require('express-jwt');

const app = express();
const secret = 'your_jwt_secret';

// Middleware to protect routes
app.use('/protected', expressJwt({ secret, algorithms: ['HS256'] }));

app.get('/protected', (req, res) => {
  res.send('This is a protected route');
});

// Route to generate JWT
app.get('/login', (req, res) => {
  const token = jwt.sign({ userId: 1 }, secret, { expiresIn: '1h' });
  res.json({ token });
});

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

alg Parameter Value	Digital Signature or MAC Algorithm
HS256	HMAC using SHA-256 hash algorithm
HS384	HMAC using SHA-384 hash algorithm
HS512	HMAC using SHA-512 hash algorithm
RS256	RSASSA-PKCS1-v1_5 using SHA-256 hash algorithm
RS384	RSASSA-PKCS1-v1_5 using SHA-384 hash algorithm
RS512	RSASSA-PKCS1-v1_5 using SHA-512 hash algorithm
PS256	RSASSA-PSS using SHA-256 hash algorithm (only node ^6.12.0 OR >=8.0.0)
PS384	RSASSA-PSS using SHA-384 hash algorithm (only node ^6.12.0 OR >=8.0.0)
PS512	RSASSA-PSS using SHA-512 hash algorithm (only node ^6.12.0 OR >=8.0.0)
ES256	ECDSA using P-256 curve and SHA-256 hash algorithm
ES384	ECDSA using P-384 curve and SHA-384 hash algorithm
ES512	ECDSA using P-521 curve and SHA-512 hash algorithm
none	No digital signature or MAC value included

Integration with Frameworks

Token Handling

Flexibility and Customization

Ease of Use: Code Examples

jsonwebtoken

Install

Migration notes

Usage

jwt.sign(payload, secretOrPrivateKey, [options, callback])

Token Expiration (exp claim)

jwt.verify(token, secretOrPublicKey, [options, callback])

jwt.decode(token [, options])

Errors & Codes

TokenExpiredError

JsonWebTokenError

NotBeforeError

Algorithms supported

Refreshing JWTs

TODO

Issue Reporting

Author

License