Skip to content

"JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno.

License

panva/jose

main
Switch branches/tags
Code

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
Jun 16, 2022

jose

"JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno.

Implemented specs & features

The following specifications are implemented by jose

The test suite utilizes examples defined in RFC7520 to confirm its JOSE implementation is correct.

💗 Help the project

Documentation

example ESM import

import * as jose from 'jose'

example CJS require

const jose = require('jose')

example Deno import

import * as jose from 'https://deno.land/x/jose/index.ts'

Supported Runtimes, Environments, Platforms

FAQ

Supported Versions

Version Security Fixes 🔑 Other Bug Fixes 🐞 New Features
v4.x
v3.x, v2.x, v1.x

Semver?

Yes. All module's public API is subject to Semantic Versioning 2.0.0.

How is it different from jws, jwa or jsonwebtoken?

  • it supports Browser, Cloudflare Workers, and Deno runtimes
  • it supports encrypted JWTs (i.e. in JWE format)
  • supports secp256k1, Ed25519, Ed448, X25519, and X448
  • it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)
  • it is exclusively using native platform Key object representations (CryptoKey and KeyObject)
  • there is JSON Web Encryption support
  • it supports the General and Flattened JSON Serialization Syntaxes
  • it supports the "crit" member validations to make sure extensions are handled correctly

How is it different from node-jose?

node-jose is built to work in any javascript runtime, to be able to do that it packs a lot of polyfills and javascript implementation code in the form of node-forge, this significantly increases the footprint of the modules with dependencies that either aren't ever used or have native implementation available in the runtime already, those are often times faster and more reliable.

  • supports secp256k1, Ed25519, Ed448, X25519, and X448

Uint8Array?!

  • Whenever Uint8Array is a valid input, so is Buffer since buffers are instances of Uint8Array.
  • Whenever Uint8Array is returned and you want a Buffer instead, use Buffer.from(uint8array).

Bundle Size, Package Size, Tree Shaking

Yes the bundle size is on the larger side, that is because each module is actually published multiple times so that it can remain truly without dependencies and be universal / isomorphic.

Nevertheless, since each module can be required independently and is fully tree-shakeable, the install size should not be a cause for concern.