jose

Zero-dependency JWT, JWE, JWS, and JWK toolkit for Node.js, the browser, and edge runtimes.

jose

Node.js

Zero-dependency JWT, JWE, JWS, and JWK toolkit for Node.js, the browser, and edge runtimes.

npm GitHub Docs

Fit

Bundle (gzip)

18.0 kB

65.4 kB raw

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

Signing and verifying JWTs securely means getting a lot of cryptographic details right — algorithm confusion attacks, key formats, expiry and audience validation. Many older libraries pull in native dependencies and don't run on edge or serverless runtimes.

What It Does

jose implements the full JOSE suite (JWS, JWE, JWK, JWT) on top of the Web Crypto API, so it runs unchanged in Node.js, Deno, Cloudflare Workers, and browsers with no native dependencies. It enforces safe defaults — you must specify allowed algorithms — and validates standard claims like exp, aud, and iss for you.

Installation

bash

npm install jose

Usage Example

import { SignJWT, jwtVerify } from 'jose';

const secret = new TextEncoder().encode(process.env.JWT_SECRET);

const token = await new SignJWT({ sub: 'user_123', role: 'admin' })
  .setProtectedHeader({ alg: 'HS256' })
  .setExpirationTime('2h')
  .sign(secret);

const { payload } = await jwtVerify(token, secret, { algorithms: ['HS256'] });

Related packages

accesscontrolNode.js

Role and attribute based access control (RBAC + ABAC) for Node.js with a fluent, readable API.

bcryptjsNode.js

Pure JavaScript bcrypt password hashing — no native dependencies, same API as bcrypt, works anywhere Node.js runs.

bullmqNode.js

Premium message queue and job scheduler for Node.js backed by Redis — reliable background job processing with retries, priorities, and rate limiting.

casbinNode.js

A powerful authorization library that supports RBAC, ABAC, ACL and more via configurable policy models.

dotenvNode.js

Load environment variables from a `.env` file into `process.env` — the standard way to manage configuration in Node.js apps.