nao1215/jose

[](https://github.com/nao1215/jose/actions/workflows/reviewdog.yml) [](https://github.com/nao1215/jose/actions/workflows/linuxtest.yml) [](https://github.com/nao1215/jose/actions/workflows/mactest.yml) [](https://github.com/nao1215/jose/actions/workflows/windows.yml) [](https://github.com/nao1215/jose/actions/workflows/e2etest.yml) [](https://github.com/nao1215/atago) [](https://github.com/nao1215/himorime) [](https://github.com/nao1215/jose/releases)

jose

jose is a command line tool for JSON Object Signing and Encryption (JOSE). It generates keys (JWK), publishes key sets (JWKS), signs and verifies messages (JWS), and encrypts and decrypts messages (JWE) from the shell, so you can work with JOSE without writing a program. It is built on github.com/lestrrat-go/jwx (MIT license, by lestrrat).

Documentation: https://nao1215.github.io/jose/ (cookbook, reference)

Install

brew install nao1215/tap/jose

Or build from source with Go 1.26 or later. jwx v4 uses encoding/json/v2, which Go 1.26 still keeps behind GOEXPERIMENT=jsonv2:

GOEXPERIMENT=jsonv2 go install github.com/nao1215/jose@latest

Prebuilt binaries and .deb/.rpm/.apk packages are on the release page. jose is tested on Linux (the main target), macOS, and Windows.

Quick start

Generate a key, sign a payload, and verify it back:

jose jwk generate --type EC --curve P-256 --output ec.jwk
echo '{"sub":"alice"}' | jose jws sign --algorithm ES256 --key ec.jwk > token.jws
jose jws verify --algorithm ES256 --key ec.jwk token.jws

Every command that reads a message or a key file also reads a pipe, and jws parse and jws verify take a token inline:

Make an ES256 key with a key ID, and print the JWKS a verifier would fetch:

jose jwk generate --type EC --curve P-256 --kid key-1 --alg ES256 --use sig --output key.jwk
jose jwk public --set key.jwk

Those two commands are also what a Bluesky / AT Protocol OAuth confidential client needs for privatekeyjwt. The cookbook recipe atproto OAuth: keys for a confidential client covers the client metadata, a hand-signed client assertion, and key rotation.

What jose does

| You want to | Run | |:--|:--| | Generate an RSA, EC, OKP, or oct key, optionally with kid, alg, and use | jose jwk generate | | Turn private keys (JWK or PEM) into a publishable JWKS | jose jwk public | | Sign a payload or a JWT | jose jws sign | | Verify against a key or a JWKS, by algorithm or by kid | jose jws verify | | Decode a token without a key | jose jws parse | | Encrypt and decrypt | jose jwe encrypt, jose jwe decrypt | | List the algorithm names jose accepts | jose jwa |