jose is an MIT-licensed TypeScript module for JSON Object Signing and Encryption — JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK) and JSON Web Key Set (JWKS) — that runs on Node.js, browsers, Cloudflare Workers, Deno, Bun and other Web-interoperable runtimes.

What it is

jose is a JavaScript module published to npmjs.com as jose and to jsr.io as @panva/jose, with additional distribution through jsdelivr.com and GitHub. It implements the JOSE family of standards: JWA for algorithms, JWS for signatures and MACs, JWE for encryption, JWT for signed and encrypted token claims sets, and JWK/JWKS for key material. The module ships as tree-shakeable ESM and has zero dependencies, so nothing is pulled in transitively.

The concrete problem it solves is runtime portability of token cryptography. An application that must verify a JWT in a Node.js service, in a browser, and in a Cloudflare Worker can use one set of functions rather than separate code paths per runtime. The library also normalises key handling across formats, importing and exporting JWK, SPKI public keys, X.509 certificates and PKCS #8 private keys, and it resolves signing keys from a published JWKS through createRemoteJWKSet, so key rotation does not require redeploying the verifier.

Key capabilities

• JWT verification and claims set validation through jwtVerify, with remote key resolution via createRemoteJWKSet and local JWKS via createLocalJWKSet.
• JWT signing with the SignJWT class, and encrypted tokens through jwtDecrypt and the EncryptJWT class.
• Token inspection helpers decodeProtectedHeader and decodeJwt, the latter used to read a claims set before it is validated.
• JWS signing and verification over arbitrary payloads in Compact, Flattened JSON and General JSON serializations, using CompactSign, FlattenedSign, GeneralSign, compactVerify, flattenedVerify and generalVerify per RFC 7515 Section 7.
• Key utilities covering import (importJWK, importSPKI, importX509, importPKCS8), generation (generateKeyPair, generateSecret) and export (exportJWK, exportPKCS8, exportSPKI).
• A dependency-free, tree-shakeable ESM build.

Who uses it and how

• Edge and serverless deployments on Cloudflare Workers, Deno and Bun, which the project lists as first-class targets alongside Node.js and the browser.
• Node.js services that issue tokens with SignJWT and validate inbound ones with jwtVerify.
• Browser code that needs to read a token's protected header or claims set with decodeProtectedHeader and decodeJwt.
• Applications that consume an identity provider's published JWKS, using createRemoteJWKSet so key rotation is picked up without a deploy.
• Services that need confidentiality as well as integrity, encrypting tokens with EncryptJWT and reading them back with jwtDecrypt.

Getting started

jose is distributed via npmjs.com, jsr.io (@panva/jose), jsdelivr.com and GitHub; the documented ESM entry point is import * as jose from 'jose'. No build step or server component is required to begin using it.

How it compares

The facts provided name no list of paid products that jose replaces. Among the tools it is associated with, the jsonwebtoken topic appears in its own tag list, which places jose in the same JWT handling territory while its stated scope is Web-interoperable runtimes rather than one runtime. The README's sponsor note points readers who want a managed path to Auth0's JavaScript SDK and free plan, which is a hosted offering rather than an alternative implementation.

When to use it — and when not to

A self-hoster adopting jose has to operate the surrounding auth infrastructure themselves: key generation and storage, JWKS publication and rotation, algorithm selection, and claims policy. It is a library, not a service, so there is no database, SMTP or hosted option in this registry to run — the operational burden is key management and correct verification logic. Teams that want a managed authentication flow should look at hosted options such as the Auth0 JavaScript SDK referenced in the README, and anyone unwilling to own cryptographic policy should not treat the library as an out-of-the-box auth system.

import * as jose from 'jose'