{"id":18141534,"url":"https://github.com/skjolber/java-jwt-benchmark","last_synced_at":"2025-04-22T13:17:40.388Z","repository":{"id":40358312,"uuid":"135357225","full_name":"skjolber/java-jwt-benchmark","owner":"skjolber","description":"Project for benchmarking popular Json Web Token (JWT) frameworks for Java using JMH.","archived":false,"fork":false,"pushed_at":"2025-02-25T19:43:14.000Z","size":1694,"stargazers_count":12,"open_issues_count":6,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-13T01:41:14.440Z","etag":null,"topics":["benchmark","gradle","java","java-jwt","jjwt","jmh","jwt","okta-oidc"],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/skjolber.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-05-29T22:00:06.000Z","updated_at":"2025-02-12T00:10:12.000Z","dependencies_parsed_at":"2023-12-15T15:29:15.844Z","dependency_job_id":"3f65cc9d-dfd3-42fd-a979-748a9c0cebd9","html_url":"https://github.com/skjolber/java-jwt-benchmark","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skjolber%2Fjava-jwt-benchmark","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skjolber%2Fjava-jwt-benchmark/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skjolber%2Fjava-jwt-benchmark/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/skjolber%2Fjava-jwt-benchmark/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/skjolber","download_url":"https://codeload.github.com/skjolber/java-jwt-benchmark/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246201153,"owners_count":20739707,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["benchmark","gradle","java","java-jwt","jjwt","jmh","jwt","okta-oidc"],"created_at":"2024-11-01T17:07:28.878Z","updated_at":"2025-03-31T02:31:49.756Z","avatar_url":"https://github.com/skjolber.png","language":"Java","readme":"# java-jwt-benchmark\nProject for benchmarking popular Json Web Token (JWT) frameworks for Java using [JMH].\n\nSupported frameworks: \n  * [java-jwt] from [Auth0]\n  * [jjwt] from jwtk\n  * [Okta JWT Verifier for Java] from Okta\n  * [fusionauth-jwt] from [FusionAuth]\n  * [Nimbus-JOSE-JWT] from [connect2id]\n\n## License\n[Apache 2.0]\n\n# Obtain\nThe project is based on [Gradle].\n\n# Usage\nModify the build version to your current snapshot, then run \n\n```\n./gradlew --stop \u0026\u0026 ./gradlew clean jmhClasses jmh --refresh-dependencies --info\n```\n\nNote: Requires Java 8 to build, there is some classpath issue with Java 11 which I've yet to understand.\n\n## Disable CPU Boost\n\nTemporarily disable boost (untill next reboot) for AMD:\n\n \u003e echo \"0\" | sudo tee /sys/devices/system/cpu/cpufreq/boost\n\nThe JMH plugin seems to have trouble refreshing the project, so restart the Gradle deamon before running.\n## Benchmarks\n\n  * Parse token (if possible)\n  * Verify token\n  * Verify token, get claim.\n\n## General performance observations\nThere is not much headroom for improving the performance of RSA-based signatures; most (\u003e 90%) of the CPU time goes to signature verification. \n\nThis observation is based on two simple 'baseline' RSA-based JWT verifiers included in this project. They perform about 5% faster than the fastest JWT libraries, \nbut then only does signature verification and no JSON parsing / field validation. So it seems likely this is the upper limit.\n\n## Latest results\nRunning for OpenJDK 21 build 21.0.6+7 on Fedora Linux 6.12.9-200, AMD Ryzen 9950.\n\nResult visualizations:\n\n * [visualization_v1.6.0]\n \nSummary: For JWT verification [fusionauth-jwt] and [java-jwt] are tied for first place. [fusionauth-jwt] can parse faster (without verification).\n\n# Previous results\nNote that **the relative number matters**, benchmarks are not necessarily run on the same machine, operating system or Java version.\n\n## Version 1.5.0:\nRunning for OpenJDK 11 build 11.0.18+10 and OpenJDK 17 build 17.0.6+10, on Fedora Linux 6.1.8-200, AMD Ryzen 5950.\n\n* [visualization_v1.5.0]\n\nSummary: For JWT verification [fusionauth-jwt] and [java-jwt] are tied for first place. [fusionauth-jwt] can parse faster (without verification).\n\n## Version 1.4.0:\nRunning for OpenJDK 11 build 11.0.11.0.9, Fedora Linux 5.13.4-200, AMD Ryzen 7 PRO 3700U laptop.\n\nA [visualization_v1.4.0] is available. In short, [fusionauth-jwt] is the fastest parser, but Java-jwt is very close.\n\n## Version 1.3.0:\nRunning for OpenJDK 1.8.0 build 275-b01, Fedora Linux 5.10.7-200, AMD 5950x.\n\nA [visualization_v1.3.0] is available, summery:\n\n| Framework | Version | Verify (op/s) | Claim (op/s) | Parse (op/s)\n| --------- | ----- |----- | ----- | ----- |\n|[java-jwt] | 3.12.0/0.15.0 | 30.1k | 29.9k | 387k |\n|[fusionauth-jwt]| 4.0.1 | 32.6k | 32.4k | 1196k |\n|[jjwt] | 0.9.1 | 31.4k | 30.7k | |\n|[Nimbus-JOSE-JWT]| 9.4.1 | 19.7k | 18.9k | 945k |\n|[Okta JWT Verifier for Java]| 0.5.0 | 1.3k | 1.3k | |\n\nIn short, [fusionauth-jwt] is the fastest parser. Parsing without validation is now faster than before for java-jwt, otherwise no improvements.\n\n## Version 1.2.0:\nRunning for OpenJDK 1.8.0 build 232, Linux 5.3.7.\n\nA [visualization_v1.2.0] is available, summery:\n\n| Framework | Version | Verify (op/s) | Claim (op/s) | Parse (op/s)\n| --------- | ----- |----- | ----- | ----- |\n|[java-jwt] | 3.8.3/0.9.0 | 14.6k | 14.6k | 230.8k |\n|[jjwt] | 0.9.1 | 14.9k | 14.5k | |\n|[Okta JWT Verifier for Java]| 0.4.0 | 0.6k | 0.6k | |\n|[fusionauth-jwt]| 3.1.6 | 15.9k | 15.7k | 581.5k |\n\nIn short, [fusionauth-jwt] is the new fastest parser. Parsing without validation is now faster than before for java-jwt, otherwise no improvements.\n\n## Version 1.1.0:\nRunning for OpenJDK 1.8.0 build 191.\n\nA [visualization_v1.1.0] is available, summery:\n\n| Framework | Version | Verify (op/s) | Claim (op/s) |\n| --------- | ----- |----- | ----- |\n|[java-jwt] | 3.7.0/0.7.0 | 14.5k | 14.6k |\n|[jjwt] | 0.9.1 | 14.7k | 14.9k |\n|[Okta JWT Verifier for Java]| 0.4.0 | 0.61k | 0.61k |\n\nIn short, **java-jwt did catch up with jjwt, they were essentially just as fast**. \nThe Okta JWT verifiser regressed into a total disaster. \n\nOnly [java-jwt] seems to parse without validation, at about 52.3k operations per second.\n\n## Version 1.0.0:\n\nRunning for Oracle JDK 1.8 build unknown-\n\nA [visualization_v1.0.0] is available, summery:\n\n| Framework | Version | Verify (op/s) | Claim (op/s) |\n| --------- | ----- |----- | ----- |\n|[java-jwt] | 3.3.0/0.4.0 | 14.2k | 13.9k |\n|[jjwt] | 0.9.0 | 19k | 18.3k |\n|[Okta JWT Verifier for Java]| 0.3.0 | 17.1k | 17.1k |\n\nOnly [java-jwt] seems to parse without validation, at about 65.2k operations per second.\n\n# History\n\n - 1.6.0: Updated dependencies\n - 1.x: Added baseline JWT verifiers\n - 1.5.0: Updated dependencies\n - 1.3.0: Updated dependencies, added Nimbus JOSE + JWT\n - 1.2.0: Added FusionAuth\n - 1.1.0: Bumped versions after accepted performance-enhancing [PR#255] for java-jwt.\n - 1.0.0: Initial version\n\n[Apache 2.0]:          \t\t\thttp://www.apache.org/licenses/LICENSE-2.0.html\n[issue-tracker]:       \t\t\thttps://github.com/skjolber/java-jwt-benchmark/issues\n[Gradle]:              \t\t \thttps://gradle.org/\n[java-jwt]:\t\t\t\thttps://github.com/auth0/java-jwt\n[Auth0]:\t\t\t\thttps://auth0.com\n[JMH]:\t\t\t\t\thttp://openjdk.java.net/projects/code-tools/jmh/\n[jjwt]:\t\t\t\t\thttps://github.com/jwtk/jjwt\n[Okta JWT Verifier for Java]: \t\thttps://github.com/okta/okta-jwt-verifier-java\n[visualization_v1.0.0]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.0.0/index.html\n[visualization_v1.1.0]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.1.0/index.html\n[visualization_v1.2.0]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.2.0/index.html\n[visualization_v1.3.0]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.3.0/index.html\n[visualization_v1.4.0]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.4.0/index.html\n[visualization_v1.5.0_jdk11]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.5.0_jdk11/index.html\n[visualization_v1.5.0_jdk17]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.5.0_jdk17/index.html\n[visualization_v1.6.0]:\t\t\thttps://skjolber.github.io/java-jwt-benchmark/jmh_v1.6.0/index.html\n[PR#255]:\t\t\t\thttps://github.com/auth0/java-jwt/pull/255\n[fusionauth-jwt]:\t\t\thttps://github.com/FusionAuth/fusionauth-jwt\n[FusionAuth]:\t\t\t\thttps://fusionauth.io/\n[Nimbus-JOSE-JWT]:\t\t\thttps://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/\n[connect2id]:\t\t\t\thttps://connect2id.com/\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskjolber%2Fjava-jwt-benchmark","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fskjolber%2Fjava-jwt-benchmark","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fskjolber%2Fjava-jwt-benchmark/lists"}