{"id":16387211,"url":"https://github.com/alexeichhorn/python-json-work-proof","last_synced_at":"2026-05-14T18:33:45.622Z","repository":{"id":62573108,"uuid":"352167424","full_name":"alexeichhorn/python-json-work-proof","owner":"alexeichhorn","description":"JSON Work Proof - proof-of-work algorithm encoded like a JWT","archived":false,"fork":false,"pushed_at":"2021-10-28T14:54:40.000Z","size":39,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-04-15T04:08:14.841Z","etag":null,"topics":["claims","ddos-prevention","hashcash","json","jwt","proof-of-work","python"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alexeichhorn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-03-27T20:11:13.000Z","updated_at":"2021-10-28T14:54:43.000Z","dependencies_parsed_at":"2022-11-03T20:46:31.323Z","dependency_job_id":null,"html_url":"https://github.com/alexeichhorn/python-json-work-proof","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/alexeichhorn/python-json-work-proof","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexeichhorn%2Fpython-json-work-proof","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexeichhorn%2Fpython-json-work-proof/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexeichhorn%2Fpython-json-work-proof/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexeichhorn%2Fpython-json-work-proof/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexeichhorn","download_url":"https://codeload.github.com/alexeichhorn/python-json-work-proof/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexeichhorn%2Fpython-json-work-proof/sbom","scorecard":{"id":181245,"data":{"date":"2025-08-11","repo":{"name":"github.com/alexeichhorn/python-json-work-proof","commit":"c26da4b418e964989eadac226b4dc34c8c6fb15c"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.1,"checks":[{"name":"Code-Review","score":0,"reason":"Found 0/24 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/pytest.yml:1","Warn: no topLevel permission defined: .github/workflows/python-publish.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pytest.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/alexeichhorn/python-json-work-proof/pytest.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pytest.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/alexeichhorn/python-json-work-proof/pytest.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python-publish.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/alexeichhorn/python-json-work-proof/python-publish.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/python-publish.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/alexeichhorn/python-json-work-proof/python-publish.yml/main?enable=pin","Warn: pipCommand not pinned by hash: .github/workflows/pytest.yml:28","Warn: pipCommand not pinned by hash: .github/workflows/pytest.yml:29","Warn: pipCommand not pinned by hash: .github/workflows/pytest.yml:30","Warn: pipCommand not pinned by hash: .github/workflows/python-publish.yml:23","Warn: pipCommand not pinned by hash: .github/workflows/python-publish.yml:24","Info:   0 out of   4 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   5 pipCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":0,"reason":"license file not detected","details":["Warn: project does not have a license file"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}}]},"last_synced_at":"2025-08-16T18:54:39.979Z","repository_id":62573108,"created_at":"2025-08-16T18:54:39.979Z","updated_at":"2025-08-16T18:54:39.979Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33037886,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-13T13:14:54.681Z","status":"online","status_checked_at":"2026-05-14T02:00:06.663Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["claims","ddos-prevention","hashcash","json","jwt","proof-of-work","python"],"created_at":"2024-10-11T04:25:45.014Z","updated_at":"2026-05-14T18:33:45.604Z","avatar_url":"https://github.com/alexeichhorn.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# JSON Work Proof\n\nJSON Work Proof is a proof-of-work algorithm that creates a token after doing some workload. This token contains certain claims defined by you and verifies that you did this work at this time and for these claims.\n\nIt packs the security of the Hashcash algorithm *(used for Bitcoin in a similar way)* into a modern JWT-like token.\n\n## Structure of Token\n\nA token looks like this: `eyJ0eXAiOiJKV1AiLCJhbGciOiJTSEEyNTYiLCJkaWYiOjIwfQ.eyJleHAiOjE2MTY4NTA1NzAuNjU1MTQ3MSwiaGVsbG8iOiJ3b3JsZCJ9.VE6YYxIQ46lPzxyNuRYAmAMkEM`. It has the same structure as a JWT token and can therefore also be inspected on the Debugger on [jwt.io](https://jwt.io).\nIt contains three elements which are each base64url encoded. The header contains the type of the token (JWP), the hash algorithm used for the challenge (currently only SHA256 supported) and the difficulty at which the token was mined. The payload consists of the claims you specified and optionally an expiration date. The last part contains a salt and a big number (named counter in Hashcash). The work needed to generate a token is actually to find this number. It's hard to find this number, but easy to verify it's correct. (Read more about how it works on [Wikipedia](https://en.wikipedia.org/wiki/Hashcash))\n\n\n## Possible Applications\n\nCan be used to prevent DDOS attacks or as an alternative to rate limiting or captchas. \n\nE.g. you can use this to prevent brute forcing user logins: The client generates a token with the claims including username and password and sends it along with the login request. The server then first checks if the token is valid before it does any lookup. The scale of bruteforcing can therefore be massively reduced.\n\n\n\n## Usage\n\n### General\n\nTo generate and validate tokens you need to use a `JWP`-object. On creation you can specify the `difficulty`, which determines how hard the challenge should be. It defaults to `20`, which takes about a second to compute on an average computer. Each increment by one, doubles the difficulty and therefore the time it takes to generate.\n```python\nfrom json_work_proof import JWP\n\njwp = JWP() # defaults to difficulty=20\njwp_harder = JWP(difficulty=25)\n```\n\n### Generation\n\nTo generate a token, that proves you did work, create a `JWP`-object and call it with your dictionary of claims like this:\n```python\njwp = JWP()\ntoken = jwp.generate({ 'hello': 'world', 'count': 88 })\n```\n\n**Note:** A token expires 5 minutes after creation on default. You can change this by giving a custom expiration date:\n```python\nexpiration = datetime.utcnow() + timedelta(hours=1) # 1 hour from now\ntoken = jwp.generate(claims, expiration=expiration)\n\ntoken = jwp.generate(claims, expiration=None) # no expiration\n```\n\n\n\n### Validation\n\nTo check if a token is valid for a certain difficulty and to read the claims:\n```python\njwp = JWP()\ntry:\n  claims = jwp.decode(token)\nexcept JWP.DecodeError.InvalidFormat:\n  print(\"The token is formatted incorrectly\")\nexcept JWP.DecodeError.InvalidProof:\n  print(\"The difficulty this token was created at is lower than what is specified in your JWP object\")\nexcept JWP.DecodeError.Expired:\n  print(\"The token expiration is too old or too new\")\n```\n\n\nIf you just want to read the claims without verifying the proof and expiration date, you can use this instead:\n```python\nclaims = jwp.decode(token, verify=False)\n```\n\nBy default it expects the expiration date to be between now and 30 minutes in the future. You can also specify your own range of valid expiration dates like this:\n```python\nclaims = jwp.decode(token, expiration_range=JWP.DateRange(start_date, end_date)) # must be in [start_date, end_date]\nclaims = jwp.decode(token, expiration_range=JWP.DateRange.from_now(3600)) # must be in [now(), now()+3600]\nclaims = jwp.decode(token, expiration_range=JWP.DateRange.unlimited)) # all expirations are accepted\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexeichhorn%2Fpython-json-work-proof","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falexeichhorn%2Fpython-json-work-proof","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexeichhorn%2Fpython-json-work-proof/lists"}