polyjose

polyjose is a pure-Rust implementation of JWS, JWE, JWK and JWT. One core, with bindings for Node.js, WebAssembly, Kotlin and Swift, gives the same results, the same defaults and the same errors on every platform. Every binding passes the same conformance tests.

Pick your platform

Install the package for your platform and import it into your project. Each guide then signs and verifies a first token.

Rust

The polyjose crate, for servers, command-line tools and any other Rust code. It is pure Rust and needs Rust 1.89 or later.

Add it to your project:

cargo add polyjose@0.2.0

Registry: crates.io · docs.rs

Then import what you use:

use polyjose::Error;
use polyjose::header::Header;
use polyjose::jwa::SigningAlg;
use polyjose::jws::{self, ProtectedHeader, SignOptions, VerifyOptions};

Full guide for Rust →

Node.js

@polyjose/node runs polyjose in Node.js 22.12 or later as a native addon. One package, prebuilt for macOS, Linux (glibc and musl) and Windows, so nothing is compiled when you install it.

Add it to your project:

npm install @polyjose/node@0.2.0

Registry: npm

Then import it. The package is ESM:

import { jwsSignCompact, jwsVerifyCompact, PolyjoseError } from '@polyjose/node';

CommonJS code can require it, with no flag:

const { jwsSignCompact, jwsVerifyCompact, PolyjoseError } = require('@polyjose/node');

Full guide for Node.js →

Web

@polyjose/wasm is polyjose compiled to WebAssembly, for browsers, Web Workers and bundlers. It also runs in Cloudflare Workers, and has the same API as @polyjose/node.

Add it to your project:

npm install @polyjose/wasm@0.2.0

Registry: npm

Then import it, in your bundler or a module script:

import { jwsSignCompact, jwsVerifyCompact, PolyjoseError } from '@polyjose/wasm';

There is no init call to make. Importing the package does nothing, and the WebAssembly module loads on the first call.

Full guide for the web →

Kotlin

An Android library (minSdk 23) and a desktop and server JVM jar (Java 17 or later), with one Kotlin API in the package dev.polyjose. Use the first for Android and the second for the JVM.

Add it to your module's Gradle file:

build.gradle.kts (Android)

dependencies {
    implementation("dev.polyjose:polyjose:0.2.0")
}

build.gradle.kts (JVM)

dependencies {
    implementation("dev.polyjose:polyjose-jvm:0.2.0")
}

Registry: Maven Central (Android) · Maven Central (JVM)

Then import what you use:

import dev.polyjose.JwsSignOptions
import dev.polyjose.JwsVerifyOptions
import dev.polyjose.PolyjoseException
import dev.polyjose.jwsSignCompact
import dev.polyjose.jwsVerifyCompact

Full guide for Android and the JVM →

Swift

A Swift package for iOS 16 and later, which also builds for macOS 13 and later. It links the polyjose core as a static library, so there is nothing else to install.

In Xcode, choose File › Add Package Dependencies, enter https://github.com/bharathkontham/polyjoseand add the product Polyjose to your app target. Or add it to Package.swift:

Package.swift

dependencies: [
    .package(url: "https://github.com/bharathkontham/polyjose", from: "0.2.0"),
],
targets: [
    .target(
        name: "MyApp",
        dependencies: [
            .product(name: "Polyjose", package: "polyjose"),
        ]
    ),
]

Registry: GitHub releases

Then import it:

import Foundation
import Polyjose

Full guide for Swift →

Security first

polyjose is designed around RFC 8725: verify and decrypt take an explicit list of allowed algorithms, none is never accepted, and keys are bound to their algorithm family. These pages explain what that protects against and what it doesn’t.

Security modelWhat polyjose defends against, the defaults it enforces and its known limits.

Cryptographic foundationsThe primitive libraries polyjose builds on, with their licenses and review status.

What polyjose does not supportAlgorithms and features left out on purpose, and why.