Repository navigation
Replace jose dependency with Web Crypto API #5
Description
Summary
Replace the jose npm dependency with the native Web Crypto API to achieve a truly zero-dependency library.
Motivation
- The library advertises itself as "minimal, zero-build" but still pulls in
jose(~45kb) - Modern browsers ship Web Crypto API with full support for JWT signing, verification, and key generation
- Removing
josemeans zero dependencies, smaller bundle, no supply chain risk
Web Crypto equivalents
| jose function | Web Crypto replacement |
|---|---|
generateKeyPair |
crypto.subtle.generateKey |
SignJWT |
crypto.subtle.sign + manual JWT construction |
jwtVerify |
crypto.subtle.verify |
exportJWK |
crypto.subtle.exportKey('jwk', ...) |
calculateJwkThumbprint |
crypto.subtle.digest('SHA-256', ...) |
createRemoteJWKSet |
fetch + crypto.subtle.importKey |
decodeJwt |
JSON.parse(atob(token.split('.')[1])) |
Acceptance criteria
- All
joseimports replaced with Web Crypto API calls -
joseremoved from package.json dependencies - Zero npm dependencies
- Existing tests still pass
Activity
Replace jose dependency with Web Crypto API