jose

jose is a JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.

Sponsor

If you want to quickly add JWT authentication to JavaScript apps, feel free to check out Auth0's JavaScript SDK and free plan. Create an Auth0 account; it's free!

💗 Help the project

Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.

Dependencies: 0

jose has no dependencies and it exports tree-shakeable ESM¹.

Documentation

jose is distributed via npmjs.com, jsr.io, jsdelivr.com, and github.com.

example ESM import¹

import * as jose from 'jose'

JSON Web Tokens (JWT)

The jose module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.

JWT Claims Set Validation & Signature Verification using the jwtVerify function
- Using a remote JSON Web Key Set (JWKS)
- Using a local JSON Web Key Set (JWKS)
Signing using the SignJWT class
Utility functions
- Decoding Token's Protected Header
- Decoding JWT Claims Set prior to its validation

Encrypted JSON Web Tokens

The jose module supports encrypted JSON Web Tokens and provides functionality for encrypting and decrypting tokens, as well as their JWT Claims Set validation.

Decryption & JWT Claims Set Validation using the jwtDecrypt function
Encryption using the EncryptJWT class
Utility functions
- Decoding Token's Protected Header

Key Utilities

The jose module supports importing, exporting, and generating keys and secrets in various formats, including PEM formats like SPKI, X.509 certificate, and PKCS #8, as well as JSON Web Key (JWK).

JSON Web Signature (JWS)

The jose module supports signing and verification of JWS messages with arbitrary payloads in Compact, Flattened JSON, and General JSON serialization syntaxes.

Signing - Compact, Flattened JSON, General JSON
Verification - Compact, Flattened JSON, General JSON
- Using a remote JSON Web Key Set (JWKS)
- Using a local JSON Web Key Set (JWKS)
Utility functions
- Decoding Token's Protected Header

JSON Web Encryption (JWE)

The jose module supports encryption and decryption of JWE messages with arbitrary plaintext in Compact, Flattened JSON, and General JSON serialization syntaxes.

Encryption - Compact, Flattened JSON, General JSON
Decryption - Compact, Flattened JSON, General JSON
Utility functions
- Decoding Token's Protected Header

Other

The following are additional features and utilities provided by the jose module:

Supported Runtimes

The jose module is compatible with JavaScript runtimes that support the utilized Web API globals and standard built-in objects or are Node.js.

The following runtimes are supported (this is not an exhaustive list):

Please note that certain algorithms may not be available depending on the runtime used. You can find a list of available algorithms for each runtime in the specific issue links provided above.

Supported Versions

Version	Security Fixes 🔑	Other Bug Fixes 🐞	New Features ⭐	Runtime and Module type
v6.x	Security Policy	✅	✅	Universal² ESM¹
v5.x	Security Policy	❌	❌	Universal² CJS + ESM
v4.x	Security Policy	❌	❌	Universal² CJS + ESM
v2.x	Security Policy	❌	❌	Node.js CJS

Specifications

Details

JSON Web Signature (JWS) - RFC7515
JSON Web Encryption (JWE) - RFC7516
JSON Web Key (JWK) - RFC7517
JSON Web Algorithms (JWA) - RFC7518
JSON Web Token (JWT) - RFC7519
JSON Web Key Thumbprint - RFC7638
JSON Web Key Thumbprint URI - RFC9278
JWS Unencoded Payload Option - RFC7797
CFRG Elliptic Curve ECDH and Signatures - RFC8037
Fully-Specified Algorithms for JOSE - RFC9864
ML-DSA for JOSE - draft-ietf-cose-dilithium-10

The algorithm implementations in jose have been tested using test vectors from their respective specifications as well as RFC7520.

CJS style let jose = require('jose') is possible in Node.js versions where the require(esm) feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0). ↩ ↩² ↩³
Assumes runtime support of WebCryptoAPI and Fetch API ↩ ↩² ↩³