Universal "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK with no dependencies using native crypto runtimes

The following specifications are implemented by jose

• JSON Web Signature (JWS) - RFC7515
• JSON Web Encryption (JWE) - RFC7516
• JSON Web Key (JWK) - RFC7517
• JSON Web Algorithms (JWA) - RFC7518
• JSON Web Token (JWT) - RFC7519
• JSON Web Key Thumbprint - RFC7638
• JWS Unencoded Payload Option - RFC7797
• CFRG Elliptic Curve ECDH and Signatures - RFC8037
• secp256k1 EC Key curve support - JOSE Registrations for WebAuthn Algorithms

The test suite utilizes examples defined in RFC7520 to confirm its JOSE implementation is correct.

If you or your business use jose, please consider becoming a sponsor so I can continue maintaining it and adding new features carefree.

npm install jose

npm install jose-node-esm-runtime

npm install jose-node-cjs-runtime

npm install jose-browser-runtime

• JSON Web Tokens (JWT)
  • Signing
  • Verification & Claims Set Validation
  • Encrypted JSON Web Tokens
    • Encryption
    • Decryption & Claims Set Validation
• JSON Web Encryption (JWE)
  • Encryption - Compact, Flattened
  • Decryption - Compact, Flattened, General
• JSON Web Signature (JWS)
  • Signing - Compact, Flattened, General
  • Verification - Compact, Flattened, General
• JSON Web Key (JWK)
  • Parsing (JWK to KeyLike)
  • Conversion (KeyLike to JWK)
  • Thumbprints
  • EmbeddedJWK
• JSON Web Key Set (JWKS)
  • Verify using a remote JWKSet
• Key Pair or Secret Generation (Generate KeyLike)
  • Asymmetric Key Pair Generation
  • Symmetric Secret Generation
• Utilities
  • Decoding Token's Protected Header
• Unsecured JWT
• JOSE Errors

Legend:

• ✓ Implemented
• ✕ Not Considered

¹ Due to its use of BoringSSL the following is not supported in Electron

• A128KW, A192KW, A256KW, and all composite algorithms utilizing those
• secp256k1 EC curve
• Ed448, X25519, and X448 OKP Sub Types

² RSA1_5, OKP JWK Key Type, and secp256k1 EC curve is not supported in Web Cryptography API.

³ P-521 EC curve is not supported in Safari

⁴ 192 bit AES keys are not supported in Chromium

• Revised API
• No dependencies
• Browser support (using Web Cryptography API)
• Promise-based API

Here.

Yes. All module's public API is subject to Semantic Versioning 2.0.0.

• it supports the browser runtime
• it supports encrypted JWTs (i.e. in JWE format)
• supports secp256k1, Ed25519, Ed448, X25519, and X448
• it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)
• it is exclusively using native platform Key object representations (CryptoKey and KeyObject)
• there is JSON Web Encryption support
• it supports the flattened JWS / JWE Serialization Syntaxes
• it supports the "crit" member validations to make sure extensions are handled correctly

node-jose is built to work in any javascript runtime, to be able to do that it packs a lot of polyfills and javascript implementation code in the form of node-forge, this significantly increases the footprint of the modules with dependencies that either aren't ever used or have native implementation available in the runtime already, those are often times faster and more reliable.

• it has smaller module footprint as it does not bundle unnecessary polyfills
• it does not bundle node-forge fallbacks when crypto runtime is unavailable
• supports secp256k1, Ed25519, Ed448, X25519, and X448

• Whenever Uint8Array is a valid input, so is Buffer since buffers are instances of Uint8Array.
• Whenever Uint8Array is returned and you want a Buffer instead, use Buffer.from(uint8array).

Yes the bundle size is on the larger side, that is because each module is actually published multiple times so that it can remain truly without dependencies and be universal / isomorphic.

Nevertheless, since each module can be required independently and is fully tree-shakeable, the install size should not be a cause for concern.