`jose` is a JavaScript module for working with JOSE standards, including JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Keys (JWK, JWKS). It provides tools to sign, verify, encrypt, decrypt, import/export keys, and validate JWT claims across multiple Web-interoperable runtimes such as Node.js, browsers, Cloudflare Workers, Deno, and Bun.
Project status
- Actively maintained: the latest update was on 2026-11-01, and the upstream repository was pushed on 2026-11-02.
- Updates have been frequent, with multiple v6.2.x updates from late July through early November 2026, sometimes only days apart.
AI summary generated
Recent updates
v6.2.16
v6.2.16 fixes error handling so invalid options supplied to general JWS verification and JWE decryption are exposed instead of being masked as signature or decryption failures. The diff also includes substantial test-runner, dependency, and CI workflow changes that are not described in the release notes.
v6.2.15
v6.2.15 fixes JWE decompression so it cancels the reader when plaintext exceeds the configured limit. It also rejects negative JWKS cache durations and negative JWT clock tolerance values. No function signatures or exports changed.
Breakingv6.2.14
v6.2.14 fixes TypeScript contextual inference for JWT payloads across decoding, verification, decryption, and unsecured JWT APIs. The change is type-level, with no intentional runtime behavior change; the diff also updates test tooling and modifies test-environment capability checks.
v6.2.13
v6.2.13 is presented as a refactor focused on aligning terminology with JOSE specifications, plus improved error handling that preserves underlying causes. The code changes also include several internal renames and swaps in how JWT claim bytes are produced for signing and encryption, beyond just error-cause propagation and terminology alignment.
v6.2.12
v6.2.12 refines JWS and JWE implementation internals (notably the operation cores) and includes several performance-oriented tweaks. The release notes only mention documentation clarifications, JWS/JWE refactoring, and performance improvements, but the built web API wrappers show additional behavioral changes not called out explicitly.
v6.2.11
v6.2.11 primarily updates documentation and performs internal refactoring, including changes around how JWE key management modes are modeled in the implementation and types. The published release notes do not call out any behavioral changes, but the bundled WebCryptoAPI build shows logic updates in General JWE handling.
v6.2.10
Release v6.2.10 primarily strengthens JOSE/JWE/JWS/JWT/JWK/JWKS input validation, rejecting malformed or inconsistent serialized structures (headers, tags, payload encoding modes, and key metadata). It also introduces several internal refactors around compact processing, shared validation helpers, and JWKS local and remote caching behavior.
Securityv6.2.9
v6.2.9 introduces fixes around RFC 7516 disjointness validation for JWE header parameter names when encrypting, specifically involving generated Key Management Parameters. It also updates TypeScript typings and docs to undeprecate the PBES2 `p2c` parameter.
Breakingv6.2.8
This release primarily fixes JWE decryption behavior by enforcing single-recipient usage for JWE "alg" values "dir" and "ECDH-ES", and hardens EmbeddedJWK so non-string "alg" values are rejected. It also refactors algorithm registries (JWS/JWE) to be indexed directly and improves error reporting by naming the source of unsupported "alg"-related values.
Securityv6.2.7
v6.2.7 contains a small documented fix related to JOSE property presence checks, alongside a bundle-size refactor. The code diff shows a much broader internal refactor (switching multiple internals from object-shaped results to positional tuples) plus additional validation/behavior changes not mentioned in the release notes.
v6.2.6
v6.2.6 is primarily a TypeScript types adjustment to better accept host runtime CryptoKey declarations. The bundled browser/worker builds only show the embedded version string bump, with no other observable runtime logic changes in the provided diff. The rest of the added changes are release tooling and workflow updates.
v6.2.5
v6.2.5 focuses on tightening JOSE validation and improving error handling and typing correctness (especially around base64url, UTF-8, and JWK/CryptoKey related TypeScript definitions). The release notes also mention a broad refactor of module composition and Deno-related bundling behavior, but they do not call out any user-facing API or export-map changes.
v6.2.4
v6.2.4 primarily updates documentation (README/SECURITY) and refactors JWK export normalization. In the runtime code, JWK export output was adjusted so exported JWK objects no longer include members whose values are undefined.
v6.2.3
v6.2.3 primarily tightens PBES2 parameter validation. The release adds an explicit check that PBES2 count (p2c) must be a positive safe integer, and fails with a JWEInvalid error when it is not.
Breakingv6.2.2
v6.2.2 includes a small fix intended to ensure failed JWE deflate decompression is rejected as a JWEInvalid error. The code changes also adjust deflate stream error handling and add more defensive error wrapping around both decompression and compression.
v6.2.1
v6.2.1 is described as an internal refactor to reduce file count and footprint. The diff shows significant consolidation of JWE content encryption, JWE key management, signing utilities, and type-check helpers into new modules.
Breakingv6.2.0
v6.2.0 re-introduces support for the JWE "zip" (Compression Algorithm) header parameter, implemented via runtime Web CompressionStream/DecompressionStream. It also updates documentation to clarify what general JWS and general JWE decryption and verification return values represent. The code changes include additional constraints and a new decompression size limit option that are not mentioned in the release notes.
Featuresv6.1.3
v6.1.3 is primarily a refactor intended to avoid `export * as ...` in the published entrypoints, to satisfy Google Closure compiler constraints. The diff also includes a small change to the text of a thrown `TypeError` when an incorrect JWK type is provided, plus a set of dev dependency version bumps.
v6.1.2
Release v6.1.2 primarily refines how the library detects CryptoKey instances. It adds a fallback to checking instanceof CryptoKey in addition to the existing Symbol.toStringTag check, and updates the packaged version strings to v6.1.2 across targets.
v6.1.1
v6.1.1 focuses on documentation and internal refactors aimed at reducing JOSE JWE/JWT overhead in the Deno build. The release notes mention removing named exports in source code and some key management API exposure, but the code diff shows broader module export shape changes and some behavior-relevant utility changes.
Features