jose vs jsonwebtoken vs jwa vs jws vs node-jose
Secure JWT Handling and JOSE Implementation in Node.js
Search packages..
josejsonwebtokenjwajwsnode-joseSimilar Packages:

Secure JWT Handling and JOSE Implementation in Node.js

These packages handle JSON Web Tokens (JWT) and related cryptographic standards (JOSE) in JavaScript. jose is the modern, zero-dependency standard for new projects. jsonwebtoken is the legacy workhorse widely found in existing codebases. jws and jwa are low-level building blocks for signatures and algorithms, typically used internally by higher-level libraries. node-jose is an older implementation that has largely been superseded by jose. Choosing the right one depends on your security requirements, need for modern standards like ESM, and whether you are maintaining legacy systems or starting fresh.

Npm Package Weekly Downloads Trend

3 Years

Github Stars Ranking

Stat Detail

Package
Downloads
Stars
Size
Issues
Publish
License
jose07,759248 kB06 days agoMIT
jsonwebtoken018,19043.4 kB2089 months agoMIT
jwa010314.1 kB18a year agoMIT
jws072118.8 kB339 months agoMIT
node-jose0721353 kB734 years agoApache-2.0

Secure JWT Handling and JOSE Implementation in Node.js

When implementing authentication or secure data exchange in Node.js, you will likely encounter JSON Web Tokens (JWT) and the broader JOSE standards. The ecosystem offers several packages, but they serve very different purposes. jose and jsonwebtoken are the main contenders for full token handling, while jws, jwa, and node-jose occupy specific niches or legacy spaces. Let's break down how they differ in security, API design, and real-world usage.

🔐 Security and Algorithm Handling

Security is the most critical factor when choosing a crypto library. How a package handles algorithms can prevent severe vulnerabilities like algorithm confusion attacks.

jose enforces strict algorithm selection. You must explicitly define the algorithm in the protected header. It does not allow the token itself to dictate the verification algorithm, which prevents attackers from switching algorithms to bypass security.

// jose: Explicit algorithm definition
import { jwtVerify } from 'jose';

const { payload } = await jwtVerify(token, key, {
  algorithms: ['RS256'] // Must specify allowed algorithms
});

jsonwebtoken allows you to specify algorithms, but older versions were vulnerable if options were not passed correctly. It requires careful configuration to ensure the algorithms option is always provided during verification.

// jsonwebtoken: Options required for security
const jwt = require('jsonwebtoken');

const payload = jwt.verify(token, key, {
  algorithms: ['RS256'] // Critical to prevent algorithm confusion
});

jws provides low-level signature verification but does not validate JWT claims like exp or iss. You must implement these checks manually, which increases the risk of human error.

// jws: Manual validation required
const jws = require('jws');

const valid = jws.verify(token, 'HS256', secret);
// You must manually decode and check expiration claims

jwa focuses purely on algorithm support. It does not verify tokens. It is used to check if an algorithm is supported or to perform raw signing operations.

// jwa: Algorithm utility
const jwa = require('jwa');
const hmac = jwa('HS256');
// Only provides sign/verify methods for raw data

node-jose supports JOSE standards but lacks the modern security defaults found in jose. It requires more boilerplate to ensure secure configurations.

// node-jose: Verbose security setup
const jose = require('node-jose');
// Requires manual key management and algorithm checks

⚙️ API Design: Async vs Sync

Cryptographic operations should ideally be asynchronous to avoid blocking the Node.js event loop. This is a key differentiator between modern and legacy libraries.

jose is fully asynchronous. All signing and verification operations return Promises. This ensures that heavy crypto math does not stall your server's ability to handle other requests.

// jose: Async API
import { SignJWT } from 'jose';

const jwt = await new SignJWT({ userId: 123 })
  .setProtectedHeader({ alg: 'HS256' })
  .sign(secret);

jsonwebtoken uses a synchronous API by default. While this is simpler to write, it can block the event loop during high load. It does offer an async callback version, but the default usage is sync.

// jsonwebtoken: Sync by default
const jwt = require('jsonwebtoken');

const token = jwt.sign({ userId: 123 }, secret); // Blocks event loop

jws is also synchronous for its main methods. This shares the same performance risks as jsonwebtoken when used for heavy operations.

// jws: Sync signing
const jws = require('jws');

const token = jws.sign({
  header: { alg: 'HS256' },
  payload: { userId: 123 },
  secret: secret
});

jwa provides synchronous sign and verify methods for raw data.

// jwa: Sync operations
const sig = hmac.sign('data', secret);

node-jose uses Promises, similar to jose, but the API is more verbose and less intuitive.

// node-jose: Async but verbose
const sig = await jose.JWS.createSign({ format: 'compact' }, key)
  .update({ userId: 123 })
  .final();

🔑 Key Management and Formats

Handling keys securely is complex. Libraries differ in how they accept secrets, PEM files, and JWKs (JSON Web Keys).

jose has excellent support for various key formats including PEM, JWK, and CryptoKey. It integrates well with the Web Crypto API.

// jose: Flexible key import
import { importSPKI } from 'jose';

const publicKey = await importSPKI(pemPublicKey, 'RS256');

jsonwebtoken accepts strings or buffers for secrets and keys. It is less strict about key formats, which can sometimes lead to configuration errors.

// jsonwebtoken: String or Buffer
const payload = jwt.verify(token, publicKeyString);

jws expects secrets or keys as strings or buffers. It does not handle JWKs natively without extra work.

// jws: Raw secret
jws.verify(token, algorithm, secretBuffer);

jwa does not manage keys; it operates on raw secrets passed to the sign function.

// jwa: Raw secret passed directly
hmac.sign(data, secret);

node-jose has robust JWK support, which was a key feature in its prime, but jose now matches this with a cleaner API.

// node-jose: JWK support
const key = await jose.JWK.asKey(jwkObject);

📦 Dependencies and Bundle Footprint

For backend services, dependencies matter less than for frontend bundles, but fewer dependencies mean a smaller attack surface.

jose has zero dependencies. This reduces the risk of supply chain attacks and simplifies installation.

jsonwebtoken depends on jws, jwa, and lodash. More dependencies mean more potential maintenance issues.

jws depends on jwa and safe-buffer. It is lightweight but still pulls in external code.

jwa has no dependencies. It is a tiny utility library.

node-jose has multiple dependencies including lodash and buffer. It is heavier than jose.

🌐 Real-World Scenarios

Scenario 1: New Microservice Authentication

You are building a new auth service from scratch.

  • ✅ Best choice: jose
  • Why? Async API, zero dependencies, and modern security defaults.
// jose: New service implementation
import { SignJWT, jwtVerify } from 'jose';

export async function createToken(user) {
  return await new SignJWT(user)
    .setProtectedHeader({ alg: 'HS256' })
    .sign(process.env.JWT_SECRET);
}

Scenario 2: Maintaining Legacy Express App

You are updating an older Express app that already uses JWT.

  • ✅ Best choice: jsonwebtoken
  • Why? Rewriting auth logic introduces risk. Stick with what works unless security demands a change.
// jsonwebtoken: Legacy maintenance
app.post('/login', (req, res) => {
  const token = jwt.sign(req.user, process.env.SECRET);
  res.json({ token });
});

Scenario 3: Custom Protocol Implementation

You are implementing a non-standard signed message format.

  • ✅ Best choice: jws or jwa
  • Why? You need raw signing without JWT claim validation overhead.
// jws: Custom signature
const signature = jws.sign({
  header: { alg: 'HS256' },
  payload: customData,
  secret: key
});

Scenario 4: OIDC Provider Integration

You are integrating with an older OpenID Connect provider.

  • ⚠️ Consider: node-jose
  • Why? Some legacy OIDC libraries depend on it. However, jose is preferred if you can control the integration.
// node-jose: Legacy OIDC
const keystore = await jose.JWK.createKeyStore();

📌 Summary Table

PackageMaintenanceAPI StyleDependenciesBest Use Case
jose✅ ActiveAsync0New projects, high security
jsonwebtoken✅ ActiveSyncMultipleLegacy maintenance
jws✅ ActiveSyncFewCustom signatures
jwa✅ ActiveSync0Algorithm utilities
node-jose⚠️ LegacyAsyncMultipleOlder OIDC systems

💡 Final Recommendation

For almost all modern development, jose is the clear choice. It aligns with current security best practices, avoids blocking the event loop, and has no dependencies. It is the successor to the functionality found in node-jose and jsonwebtoken.

Reserve jsonwebtoken for maintaining existing systems where refactoring auth logic is too costly. Avoid using jws and jwa directly for authentication unless you are an cryptography expert building custom protocols, as manual implementation often leads to security gaps.

Migrate away from node-jose when possible. While it still works, the community has consolidated around jose for future updates and support.

How to Choose: jose vs jsonwebtoken vs jwa vs jws vs node-jose

  • jose:

    Choose jose for all new projects requiring JWT or JOSE support. It is actively maintained, supports both ESM and CommonJS, and enforces async crypto operations for better security. It is the current industry standard recommended by security experts for its robust API and lack of dependencies.

  • jsonwebtoken:

    Choose jsonwebtoken only if you are maintaining an existing codebase that already relies on it. While still maintained, it uses synchronous crypto by default which can block the event loop, and it lacks native ESM support compared to jose. Avoid using it for new greenfield projects.

  • jwa:

    Choose jwa only if you are building a custom cryptographic protocol and need low-level algorithm validation or signing primitives. It is not suitable for standard JWT authentication flows because it does not handle token structure, expiration, or claims validation out of the box.

  • jws:

    Choose jws if you need to implement custom JSON Web Signature logic without the overhead of full JWT claims handling. Like jwa, it is a low-level utility. For standard authentication, prefer jose or jsonwebtoken to avoid security pitfalls associated with manual signature implementation.

  • node-jose:

    Do not choose node-jose for new projects. It is considered legacy software and has been superseded by the jose package. Existing projects using it should plan a migration to jose to ensure continued security updates and compatibility with modern Node.js features.

Similar Npm Packages to jose

jose is a modern JavaScript library for working with JSON Web Tokens (JWT), JWS (JSON Web Signature), JWE (JSON Web Encryption), and other related standards. It provides a comprehensive set of tools for creating, parsing, and validating JWTs and other token formats, making it a versatile choice for developers looking to implement secure authentication and authorization in their applications. While jose is a powerful library, there are several alternatives in the ecosystem that offer similar functionalities. Here are a few noteworthy options:

  • jsonwebtoken is one of the most widely used libraries for creating and verifying JSON Web Tokens in Node.js applications. It provides a simple API for signing and verifying tokens, making it easy to implement authentication and authorization in your applications. If you are looking for a straightforward solution for handling JWTs without the need for additional features, jsonwebtoken is a solid choice.

  • jwa is a library that focuses on JSON Web Algorithms, providing a set of cryptographic algorithms for signing and verifying tokens. It is often used in conjunction with other libraries to handle JWTs and JWS. If you need a lightweight solution specifically for handling cryptographic algorithms related to JWTs, jwa is a good option.

  • jws is a library for creating and verifying JSON Web Signatures. It provides a simple API for signing and verifying payloads using various algorithms. If your primary focus is on signing and verifying data rather than handling the full JWT lifecycle, jws can be a suitable alternative.

  • node-jose is a comprehensive library for working with JSON Object Signing and Encryption (JOSE) standards, including JWT, JWS, and JWE. It offers a wide range of features, including key management and support for various cryptographic algorithms. If you need a full-featured library that covers all aspects of JOSE standards, node-jose is a great choice.

To explore how jose compares with these alternatives, check out the comparison: Comparing jose vs jsonwebtoken vs jwa vs jws vs node-jose.

Similar Npm Packages to jsonwebtoken

jsonwebtoken is a widely-used library for creating and verifying JSON Web Tokens (JWT) in Node.js applications. JWTs are a compact, URL-safe means of representing claims to be transferred between two parties. The jsonwebtoken library provides a simple API for signing and verifying tokens, making it a popular choice for authentication and authorization in web applications. It supports various algorithms for signing tokens and allows developers to easily manage user sessions and secure API endpoints.

While jsonwebtoken is a robust solution for handling JWTs, there are alternatives that cater to different needs:

  • jwt-decode is a lightweight library that focuses solely on decoding JWTs. Unlike jsonwebtoken, which can both sign and verify tokens, jwt-decode is used to extract the payload from a JWT without validating its signature. This can be useful when you need to read the claims contained in a token without requiring the secret key. If your application needs to read JWTs but does not require signing or verifying them, jwt-decode is a great choice.
  • jwt-simple is another library that provides a simple way to encode and decode JSON Web Tokens. It offers a minimalist API for creating and verifying tokens, focusing on simplicity and ease of use. While it does not support as many features as jsonwebtoken, such as advanced signature algorithms or token expiration handling, it can be a good option for projects that require a straightforward implementation of JWTs without the overhead of a more complex library.

To compare these libraries, check out the following link: Comparing jsonwebtoken vs jwt-decode vs jwt-simple.

Similar Npm Packages to jwa

jwa is a JSON Web Algorithms library that provides a set of cryptographic algorithms for creating and verifying JSON Web Tokens (JWTs). It is designed to be lightweight and efficient, making it a suitable choice for developers who need to implement JWT-based authentication and authorization in their applications. While jwa offers a solid foundation for working with JWTs, there are several alternatives in the ecosystem that provide additional features or different approaches to JWT handling. Here are a few notable alternatives:

  • express-jwt is a middleware for Express.js that helps protect routes by validating JWTs. It automatically checks the incoming requests for a valid JWT in the authorization header and can reject requests that do not contain a valid token. This library is particularly useful for developers building RESTful APIs with Express who want to implement authentication and authorization quickly and efficiently.
  • jose is a comprehensive library for handling JSON Web Tokens and related standards such as JWS, JWE, and JWK. It provides a wide range of features for creating, verifying, and manipulating JWTs, making it a powerful choice for developers who require more advanced capabilities. If your application needs to handle various JWT-related tasks beyond basic signing and verification, jose is an excellent option.
  • jsonwebtoken is one of the most widely used libraries for creating and verifying JWTs in Node.js applications. It provides a simple API for signing and verifying tokens, along with options for handling expiration and audience claims. If you're looking for a straightforward and reliable solution for JWT handling, jsonwebtoken is a great choice that has been battle-tested in many applications.
  • passport-jwt is a Passport.js strategy for authenticating with JWTs. It integrates seamlessly with the Passport authentication middleware, allowing developers to add JWT authentication to their applications easily. If you're already using Passport for authentication in your application and want to incorporate JWTs, passport-jwt provides a convenient way to do so.

For a comprehensive comparison of these packages, check out the link: Comparing express-jwt vs jose vs jsonwebtoken vs jwa vs passport-jwt.

Similar Npm Packages to jws

jws is a JavaScript library for creating and verifying JSON Web Signature (JWS) tokens. It provides a simple interface for signing and verifying data using various algorithms, making it a popular choice for developers who need to implement secure token-based authentication in their applications. While jws is a robust solution for handling JWS tokens, there are several alternatives in the ecosystem that offer similar functionality. Here are a few noteworthy options:

  • crypto-js is a widely-used library that provides a variety of cryptographic algorithms, including hashing and encryption. While it is not specifically focused on JWS, it can be used in conjunction with other libraries to create secure tokens. If you need a comprehensive set of cryptographic functions beyond just JWS, crypto-js is a solid choice.
  • jose is a modern library for handling JSON Web Tokens (JWT) and JSON Web Encryption (JWE). It supports a wide range of algorithms and is designed to be compliant with the latest specifications. If you are looking for a library that provides both JWS and JWT functionality with a focus on security and standards compliance, jose is an excellent option.
  • jsonwebtoken is a popular library for creating and verifying JSON Web Tokens (JWT). It is widely used in authentication workflows and provides a straightforward API for signing and verifying tokens. If your primary focus is on JWT rather than JWS, jsonwebtoken is a well-established choice with extensive community support.
  • node-jose is another library that provides support for JWS, JWT, and JWE. It is designed to be flexible and extensible, allowing developers to work with various cryptographic algorithms. If you need a library that can handle multiple token formats and offers a high degree of customization, node-jose is worth considering.

To see how jws compares with crypto-js, jose, jsonwebtoken, and node-jose, check out the comparison: Comparing crypto-js vs jose vs jsonwebtoken vs jws vs node-jose.

Similar Npm Packages to node-jose

node-jose is a JavaScript library for Node.js that provides tools for working with JSON Web Tokens (JWT) and JSON Object Signing and Encryption (JOSE). It allows developers to create, verify, and manipulate JWTs and other JOSE-related structures easily. This library is particularly useful for applications that require secure data transmission and authentication mechanisms. While node-jose is a robust solution for handling JOSE, there are several alternatives available in the ecosystem. Here are a few notable ones:

  • crypto is a built-in Node.js module that provides cryptographic functionality, including a set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify functions. While it does not specifically focus on JOSE or JWT, it can be used to implement custom cryptographic operations. If you need low-level cryptographic capabilities or are building a solution that requires more than just JWT handling, the crypto module is a solid choice.
  • jose is a modern library for handling JSON Web Tokens and JOSE, designed to be lightweight and efficient. It supports a wide range of algorithms and provides a straightforward API for creating and verifying JWTs. If you are looking for a more modern and actively maintained alternative to node-jose, jose is an excellent option that offers similar functionality with a focus on performance and simplicity.
  • jsonwebtoken is a widely used library for creating and verifying JSON Web Tokens. It is simple to use and provides a straightforward API for handling JWTs. If your primary need is to work with JWTs specifically, jsonwebtoken is a popular choice among developers due to its ease of use and extensive documentation.
  • node-forge is a comprehensive library that provides various cryptographic tools, including support for TLS, PKI, and cryptographic algorithms. While it is more extensive than just a JWT library, it can be used to implement JOSE and JWT functionalities. If you require a broader set of cryptographic capabilities beyond just JWT handling, node-forge is a versatile option.

To explore how these libraries compare, check out the comparison: Comparing crypto vs jose vs jsonwebtoken vs node-forge vs node-jose.

README for jose

jose

jose is a JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.

Sponsor

Auth0 by Okta

If you want to quickly add JWT authentication to JavaScript apps, feel free to check out Auth0's JavaScript SDK and free plan. Create an Auth0 account; it's free!

💗 Help the project

Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.

Dependencies: 0

jose has no dependencies and it exports tree-shakeable ESM1.

Documentation

jose is distributed via npmjs.com, jsr.io, jsdelivr.com, and github.com.

example ESM import1

import * as jose from 'jose'

JSON Web Tokens (JWT)

The jose module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.

Encrypted JSON Web Tokens

The jose module supports encrypted JSON Web Tokens and provides functionality for encrypting and decrypting tokens, as well as their JWT Claims Set validation.

Key Utilities

The jose module supports importing, exporting, and generating keys and secrets in various formats, including PEM formats like SPKI, X.509 certificate, and PKCS #8, as well as JSON Web Key (JWK).

JSON Web Signature (JWS)

The jose module supports signing and verification of JWS messages with arbitrary payloads in Compact, Flattened JSON, and General JSON serialization syntaxes.

JSON Web Encryption (JWE)

The jose module supports encryption and decryption of JWE messages with arbitrary plaintext in Compact, Flattened JSON, and General JSON serialization syntaxes.

Other

The following are additional features and utilities provided by the jose module:

Supported Runtimes

The jose module is compatible with JavaScript runtimes that support the utilized Web API globals and standard built-in objects or are Node.js.

The following runtimes are supported (this is not an exhaustive list):

Please note that certain algorithms may not be available depending on the runtime used. You can find a list of available algorithms for each runtime in the specific issue links provided above.

Supported Versions

VersionSecurity Fixes 🔑Other Bug Fixes 🐞New Features ⭐Runtime and Module type
v6.xSecurity Policy✅✅Universal2 ESM1

Specifications

Details
  • JSON Web Signature (JWS) - RFC7515
  • JSON Web Encryption (JWE) - RFC7516
  • JSON Web Key (JWK) - RFC7517
  • JSON Web Algorithms (JWA) - RFC7518
  • JSON Web Token (JWT) - RFC7519
  • JSON Web Key Thumbprint - RFC7638
  • JSON Web Key Thumbprint URI - RFC9278
  • JWS Unencoded Payload Option - RFC7797
  • CFRG Elliptic Curve ECDH and Signatures - RFC8037
  • Fully-Specified Algorithms for JOSE - RFC9864
  • ML-DSA for JOSE - RFC9964

The algorithm implementations in jose have been tested using test vectors from their respective specifications as well as RFC7520.

Footnotes

  1. CJS style let jose = require('jose') is possible in Node.js versions where the require(esm) feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0). ↩ ↩2 ↩3

  2. Assumes runtime support of WebCryptoAPI and Fetch API ↩

npm-compare.com is an independent website designed to help developers choose the most suitable npm packages. We are not affiliated with npm, Inc, the official website for the npm registry. Note that npm is a registered trademark of npm, Inc. For more details, please refer to our Terms & Privacy.