jose
A comprehensive Erlang/Elixir library implementing JSON Object Signing and Encryption (JOSE) standards.
What is jose?
JOSE is an Erlang and Elixir library that implements the JSON Object Signing and Encryption (JOSE) standards, including JWT, JWS, JWE, and JWK. It provides tools for creating, signing, encrypting, and verifying JSON-based tokens and keys, enabling secure authentication and data exchange in distributed systems.
Erlang and Elixir developers building secure applications that require standards-compliant JSON Web Token handling, such as authentication systems, APIs, and microservices.
Developers choose JOSE for its exhaustive implementation of JOSE RFCs, support for both established and experimental algorithms, and seamless integration with Erlang/OTP and external cryptographic libraries, all while maintaining strong security defaults.
Overview
JSON Object Signing and Encryption (JOSE) for Erlang and Elixir
Use Cases
Best For
- Implementing JWT-based authentication in Erlang or Elixir applications
- Signing and verifying JSON Web Signatures (JWS) with multiple algorithms
- Encrypting and decrypting JSON Web Encryption (JWE) payloads
- Managing JSON Web Keys (JWK) from PEM files or generated in-memory
- Building interoperable security protocols that require JOSE compliance
- Experimenting with draft JOSE standards like ECDH-1PU and ChaCha20-based algorithms
Not Ideal For
- Projects that only require basic JWT validation without full JOSE standards compliance, such as using simple HMAC signatures in a monolithic app
- Teams operating in restricted environments where installing external C libraries (e.g., libsodium) is infeasible or prohibited
- Developers seeking an out-of-the-box authentication framework; JOSE is a low-level library requiring manual integration for auth flows
- Applications built in languages other than Erlang/Elixir where native JOSE implementations (e.g., in Node.js or Python) might offer better ecosystem integration
Pros & Cons
Pros
Implements a vast array of JWE, JWS, and JWK algorithms, including experimental drafts like ECDH-1PU and ChaCha20, as detailed in the ALGORITHMS.md and README listings.
Disables the vulnerable 'none' signing algorithm by default and provides verify_strict for algorithm restriction, preventing common security pitfalls as highlighted in the README's security section.
Supports external libraries like libsodium and libdecaf for accelerated operations, with configurable modules to swap between pure Erlang fallbacks and faster implementations, as shown in setup examples.
Offers pure Erlang fallbacks for algorithms unsupported by native OTP crypto, ensuring functionality across different Erlang versions, though with performance trade-offs noted in the README.
Cons
Pure Erlang cryptographic implementations are explicitly labeled 'slow' in the README, forcing reliance on external libraries for production performance, which adds deployment complexity.
Setup requires managing JSON encoder/decoder dependencies for older OTP versions and manually selecting external crypto modules, as detailed in installation and configuration sections.
Includes support for non-standard and draft algorithms (e.g., from RFC drafts), which may lead to instability or breaking changes as specifications evolve, noted in the algorithm list.
Tied specifically to the BEAM ecosystem with no cross-language support, limiting use in polyglot microservices where consistent JOSE handling across languages is needed.
Frequently Asked Questions
Related Projects
poisonAn incredibly fast, pure Elixir JSON library
jasonA blazing fast JSON parser and generator in pure Elixir.
jokenElixir JWT library
jsxan erlang application for consuming, producing and manipulating json. inspired by yajl
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.