该介绍目前仅提供英文版本。
jose is a JavaScript module for JSON Object Signing and Encryption, providing comprehensive support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.
Key Features
- Zero Dependencies: No external dependencies, exports tree-shakeable ESM
- Universal Runtime Support: Works across Node.js, browsers, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes
- Complete JOSE Implementation: Full coverage of JSON Web specifications
- JWT Capabilities: Sign, verify, encrypt, and decrypt JSON Web Tokens
- Key Management: Import, export, and generate keys in various formats (PEM, SPKI, X.509, PKCS #8, JWK)
- Multiple Serialization Formats: Support for Compact, Flattened JSON, and General JSON serializations
JSON Web Token (JWT) Support
Signing and Verification
// Creating and signing a JWT
const jwt = await new jose.SignJWT({ 'urn:example:claim': true })
.setProtectedHeader({ alg: 'ES256' })
.setIssuedAt()
.setIssuer('urn:example:issuer')
.setAudience('urn:example:audience')
.setExpirationTime('2h')
.sign(privateKey)
// Verifying a JWT
const { payload, protectedHeader } = await jose.jwtVerify(jwt, publicKey, {
issuer: 'urn:example:issuer',
audience: 'urn:example:audience'
})JWT Encryption
// Encrypting a JWT
const jwt = await new jose.EncryptJWT({ 'urn:example:claim': true })
.setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A256GCM' })
.setIssuedAt()
.setIssuer('urn:example:issuer')
.setAudience('urn:example:audience')
.setExpirationTime('2h')
.encrypt(publicKey)
// Decrypting a JWT
const { payload, protectedHeader } = await jose.jwtDecrypt(jwt, privateKey, {
issuer: 'urn:example:issuer',
audience: 'urn:example:audience'
})Advanced Key Features
- JWK Thumbprint: Calculate standard JWK thumbprints (RFC7638)
- JWK Thumbprint URI: Generate URI format thumbprints (RFC9278)
- Remote JWKS: Fetch and use remote JSON Web Key Sets
- Key Generation: Create cryptographic keys for various algorithms
Supported Specifications
- JSON Web Signature (JWS) - RFC7515
- JSON Web Encryption (JWE) - RFC7516
- JSON Web Key (JWK) - RFC7517
- JSON Web Algorithms (JWA) - RFC7518
- JSON Web Token (JWT) - RFC7519
- JSON Web Key Thumbprint - RFC7638
- JSON Web Key Thumbprint URI - RFC9278
- JWS Unencoded Payload Option - RFC7797
- CFRG Elliptic Curve ECDH and Signatures - RFC8037
