diff --git a/third_party/3/jwt/__init__.pyi b/third_party/3/jwt/__init__.pyi
new file mode 100644
index 000000000..3161c9142
--- /dev/null
+++ b/third_party/3/jwt/__init__.pyi
@@ -0,0 +1,41 @@
+from typing import Mapping, Any, Optional, Union
+
+from . import algorithms
+
+def decode(jwt: Union[str, bytes], key: Union[str, bytes] = ...,
+           verify: bool = ..., algorithms: Optional[Any] = ...,
+           options: Optional[Mapping[Any, Any]] = ...,
+           **kwargs: Any) -> Mapping[str, Any]: ...
+
+def encode(payload: Mapping[str, Any], key: Union[str, bytes],
+           algorithm: str = ..., headers: Optional[Mapping[str, Any]] = ...,
+           json_encoder: Optional[Any] = ...) -> bytes: ...
+
+def register_algorithm(alg_id: str,
+                       alg_obj: algorithms.Algorithm) -> None: ...
+
+def unregister_algorithm(alg_id: str) -> None: ...
+
+class InvalidTokenError(Exception): pass
+class DecodeError(InvalidTokenError): pass
+class ExpiredSignatureError(InvalidTokenError): pass
+class InvalidAudienceError(InvalidTokenError): pass
+class InvalidIssuerError(InvalidTokenError): pass
+class InvalidIssuedAtError(InvalidTokenError): pass
+class ImmatureSignatureError(InvalidTokenError): pass
+class InvalidKeyError(Exception): pass
+class InvalidAlgorithmError(InvalidTokenError): pass
+class MissingRequiredClaimError(InvalidTokenError): ...
+
+# Compatibility aliases (deprecated)
+ExpiredSignature = ExpiredSignatureError
+InvalidAudience = InvalidAudienceError
+InvalidIssuer = InvalidIssuerError
+
+# These aren't actually documented, but the package
+# exports them in __init__.py, so we should at least
+# make sure that mypy doesn't raise spurious errors
+# if they're used.
+get_unverified_header = ...  # type: Any
+PyJWT = ...  # type: Any
+PyJWS = ...  # type: Any
diff --git a/third_party/3/jwt/algorithms.pyi b/third_party/3/jwt/algorithms.pyi
new file mode 100644
index 000000000..4576b4169
--- /dev/null
+++ b/third_party/3/jwt/algorithms.pyi
@@ -0,0 +1,3 @@
+from typing import Any
+
+class Algorithm(Any): ...  # type: ignore
diff --git a/third_party/3/jwt/contrib/__init__.pyi b/third_party/3/jwt/contrib/__init__.pyi
new file mode 100644
index 000000000..e69de29bb
diff --git a/third_party/3/jwt/contrib/algorithms/__init__.pyi b/third_party/3/jwt/contrib/algorithms/__init__.pyi
new file mode 100644
index 000000000..b2bb1f643
--- /dev/null
+++ b/third_party/3/jwt/contrib/algorithms/__init__.pyi
@@ -0,0 +1 @@
+from hashlib import _Hash as _HashAlg
diff --git a/third_party/3/jwt/contrib/algorithms/py_ecdsa.pyi b/third_party/3/jwt/contrib/algorithms/py_ecdsa.pyi
new file mode 100644
index 000000000..cd2926f42
--- /dev/null
+++ b/third_party/3/jwt/contrib/algorithms/py_ecdsa.pyi
@@ -0,0 +1,10 @@
+from typing import Any
+from jwt.algorithms import Algorithm
+
+from . import _HashAlg
+
+class ECAlgorithm(Algorithm):
+    SHA256 = ...  # type: _HashAlg
+    SHA384 = ...  # type: _HashAlg
+    SHA512 = ...  # type: _HashAlg
+    def __init__(self, hash_alg: _HashAlg) -> None: ...
diff --git a/third_party/3/jwt/contrib/algorithms/pycrypto.pyi b/third_party/3/jwt/contrib/algorithms/pycrypto.pyi
new file mode 100644
index 000000000..08ae8ba2d
--- /dev/null
+++ b/third_party/3/jwt/contrib/algorithms/pycrypto.pyi
@@ -0,0 +1,10 @@
+from typing import Any
+from jwt.algorithms import Algorithm
+
+from . import _HashAlg
+
+class RSAAlgorithm(Algorithm):
+    SHA256 = ...  # type: _HashAlg
+    SHA384 = ...  # type: _HashAlg
+    SHA512 = ...  # type: _HashAlg
+    def __init__(self, hash_alg: _HashAlg) -> None: ...