A minimal, zero-dependency .NET library for JWT signing, encryption, and JWK support with full JOSE compliance.
jose-jwt is a comprehensive .NET library for implementing JSON Web Tokens (JWT), JSON Web Encryption (JWE), and JSON Web Keys (JWK) according to JOSE standards. It provides a minimal, zero-dependency solution for generating, decoding, signing, and encrypting tokens, supporting the full suite of JWA algorithms and cross-platform compatibility.
.NET developers building secure authentication systems, API security layers, or applications requiring standardized token-based security with JWT/JWE/JWK support.
Developers choose jose-jwt for its complete JOSE compliance, zero dependencies, cross-platform support, and robust security features like FIPS compliance and confusion attack prevention, all in a minimalistic package.
Ultimate Javascript Object Signing and Encryption (JOSE), JSON Web Token (JWT) and Json Web Keys (JWK) Implementation for .NET and .NET Core
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements all JWA algorithms for signing and encryption, including HS*, RS*, PS*, ES* signatures and RSA, AES, ECDH, PBES2 encryption, as detailed in the supported algorithms list.
Minimalistic with no external dependencies, allowing pluggable JSON processing, which reduces bloat and increases flexibility, as emphasized in the project philosophy.
Compatible with Windows, Linux, macOS, and FreeBSD across .NET versions 4.0 to 8.0, demonstrated in the OS compatibility table for broad deployment.
Includes strict validation, confusion attack prevention, and configurable security limits, with specific fixes like forced strict AES-GCM to avoid truncated tags, enhancing robustness.
Major updates like v4 to v5 introduce breaking changes, such as default key bridging alterations and decompression limits, requiring code adjustments and careful migration as warned in the README.
Key types and behaviors vary between .NET Framework and .NET Core, with noted issues like CngKey bugs in ECDH-ES on Windows, adding implementation complexity and cross-platform concerns.
Due to its comprehensive, low-level nature and extensive algorithm support, developers need a deep understanding of JOSE standards, which can be challenging for those new to token-based security.