unjwt

A collection of JWT utilities based on the Web Crypto API, in a single zero-dependency package.

📖 Documentation — unjwt.s94.dev

Features

• JWS (RFC 7515) — HMAC, RSA, RSA-PSS, ECDSA, EdDSA. Compact + General/Flattened JSON Serialization (multi-signature).
• JWE (RFC 7516) — dir, AES-KW, AES-GCM-KW, RSA-OAEP, PBES2, ECDH-ES. AES-GCM and AES-CBC-HMAC-SHA2 content encryption. Compact + General/Flattened JSON Serialization (multi-recipient).
• JWK (RFC 7517) — generate, import, export, wrap, unwrap. CryptoKey ↔ JWK ↔ PEM conversion. ECDH-ES shared-secret derivation. JWK Set lookup and rotation over a set your application fetches.
• DPoP (RFC 9449) — create and verify proofs through the optional unjwt/dpop module. Your application owns HTTP and replay storage.
• Sessions — cookie-based JWT sessions through unjwt/session on h3 v2, Nitro 3, Nuxt 4.6+, Workers, Bun, Deno and Hono, or on a token in hand; an Elysia plugin; a driver for any other framework.
• Runtime-agnostic — Node 22+, Deno, Bun, Cloudflare Workers, browsers. Anywhere Web Crypto runs.
• Zero runtime dependencies for core; optional peer deps for adapters (h3, elysia).

Install

# Auto-detect package manager (npm, yarn, pnpm, deno, bun)
npx nypm install unjwt

Agent skill for Claude Code (and compatible harnesses):

npx skills add sandros94/unjwt

Quickstart

// Sign and verify a JWT (JWS)
import { sign, verify } from "unjwt/jws";
import { generateJWK } from "unjwt/jwk";

const key = await generateJWK("HS256");
const token = await sign({ sub: "user_1" }, key, { expiresIn: "1h" });
const { payload } = await verify(token, key);
// { sub: "user_1", iat: ..., exp: ... }

// Encrypt and decrypt (JWE)
import { encrypt, decrypt } from "unjwt/jwe";

const jwe = await encrypt({ secret: "data" }, "my-password");
const { payload: p } = await decrypt(jwe, "my-password");

Full walkthroughs, recipes, and the complete API reference live at unjwt.s94.dev:

• Getting started →
• JWS — signing and verifying →
• JWE — encrypting and decrypting →
• JWK — key management →
• Sessions on your framework →
• Examples → — authentication, JWKS endpoints, refresh tokens, end-to-end encryption, signed receipts.

Development

local development

• Clone this repository
• Install latest LTS version of Node.js
• Enable Corepack using corepack enable
• Install dependencies using pnpm install
• Run tests using pnpm test

Credits

Originally visioned by Johann Schopplich, heavily inspired by Filip Skokan's jose internal cryptographic primitives, and initially sponsored by JAMflow — thanks to all three for making this project possible.

License

Published under the MIT license. Made by community 💛

---

🤖 auto updated with automd