polyjose

polyjose is being built as a pure-Rust implementation of JWS, JWE, JWK and JWT. One core, with bindings for Node.js, WebAssembly, Kotlin and Swift, is designed to give the same results, the same defaults and the same errors on every platform. Each binding is meant to pass the same conformance tests before 0.1.0 is released.

Pre-1.0, not published yet

polyjose is pre-1.0 and not published yet: there is no release on crates.io, npm or Maven Central and no tagged Swift package, and the APIs may change before 1.0. The get-started pages say what they will cover when 0.1.0 is published.

Pick your platform

RustThe polyjose crate, for servers, command-line tools and any other Rust code.

Node.jsThe @polyjose/node package, a native addon that will ship with prebuilt binaries.

Web and edge (WASM)The @polyjose/wasm package, for browsers and edge runtimes such as Workers.

Android and JVM (Kotlin)An Android library and a desktop JVM jar that share one Kotlin API.

Swift (iOS)A Swift package for iOS apps, which also builds for iPadOS, macOS, tvOS, watchOS and visionOS.

Security first

polyjose is designed around RFC 8725: verify and decrypt take an explicit list of allowed algorithms, none is never accepted, and keys are bound to their algorithm family. These pages explain what that protects against and what it doesn’t.

Security modelWhat polyjose defends against, the defaults it enforces and its known limits.

Cryptographic foundationsThe primitive libraries polyjose builds on, with their licenses and review status.

What polyjose does not supportAlgorithms and features left out on purpose, and why.