2.2.8

Think the installation command shouldn't use `-D` as it's used in the production code right, so installing as dev dep would be confusing, right?

Please correct me if I'm wrong 🙏

Also thanks a lot for this package, was just using for a way to sign and verify JWT in Pages ❤️

.editorconfig

@@ -0,0 +1,10 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = false
+
+[src/**/*.ts]
+charset = utf-8
+indent_style = space
+indent_size = 4

.github/workflows/publish.yml

@@ -2,29 +2,29 @@ name: Publish
 
 on:
   release:
-    types: [created]
+    types: [published]
 
 jobs:
-  publish-npm:
+  publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
         with:
-          node-version: 12
+          node-version: latest
           registry-url: https://registry.npmjs.org/
-      - run: npm publish --access public
+      - name: Install dependencies
+        run: npm ci
+      - name: Build
+        run: npm run build
+      - name: Publish to npmjs
+        run: npm publish --tag latest --access public
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-
-  publish-gpr:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v3
         with:
-          node-version: 12
           registry-url: https://npm.pkg.github.com/
-      - run: npm publish --access public
+      - name: Publish to GPR
+        run: npm publish --tag latest --access public
         env:
           NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}

.gitignore

@@ -141,4 +141,8 @@ dist
 .yarn/unplugged
 .yarn/build-state.yml
 .yarn/install-state.gz
-.pnp.*
+.pnp.*
+
+# Custom
+/index.js
+/index.d.ts

.npmignore

@@ -0,0 +1,7 @@
+.github/
+src/
+.editorconfig
+index.spec.js
+index.test.js
+jest.config.ts
+tsconfig.json

README.md

@@ -8,12 +8,15 @@ A lightweight JWT implementation with ZERO dependencies for Cloudflare Workers.
 - [Install](#install)
 - [Examples](#examples)
 - [Usage](#usage)
+    - [Sign](#sign)
+    - [Verify](#verify)
+    - [Decode](#decode)
 
 
 ## Install
 
 ```
-npm i -D @tsndr/cloudflare-worker-jwt
+npm i @tsndr/cloudflare-worker-jwt
 ```
 
 
@@ -21,9 +24,9 @@ npm i -D @tsndr/cloudflare-worker-jwt
 
 ### Basic Example
 
-```javascript
+```typescript
 async () => {
-    const jwt = require('@tsndr/cloudflare-worker-jwt')
+    import jwt from '@tsndr/cloudflare-worker-jwt'
 
     // Creating a token
     const token = await jwt.sign({ name: 'John Doe', email: 'john.doe@gmail.com' }, 'secret')
@@ -36,15 +39,15 @@ async () => {
         return
 
     // Decoding token
-    const payload = jwt.decode(token)
+    const { payload } = jwt.decode(token)
 }
 ```
 
 ### Restrict Timeframe
 
-```javascript
+```typescript
 async () => {
-    const jwt = require('@tsndr/cloudflare-worker-jwt')
+    import jwt from '@tsndr/cloudflare-worker-jwt'
 
     // Creating a token
     const token = await jwt.sign({
@@ -62,56 +65,78 @@ async () => {
         return
 
     // Decoding token
-    const payload = jwt.decode(token) // { name: 'John Doe', email: 'john.doe@gmail.com', ... }
+    const { payload } = jwt.decode(token) // { name: 'John Doe', email: 'john.doe@gmail.com', ... }
 }
 ```
 
 ## Usage
 
+- [Sign](#sign)
+- [Verify](#verify)
+- [Decode](#decode)
+
 <hr>
 
-### `jwt.sign(payload, secret, [options])`
+### Sign
+#### `jwt.sign(payload, secret, [options])`
 
 Signs a payload and returns the token.
 
 #### Arguments
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `payload`   | `object` | required | -       | The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
 `secret`    | `string` | required | -       | A string which is used to sign the payload.
-`options`   | `object`, `string` | optional | `{ algorithm: 'HS256' }` | The options object supporting `algorithm` and `keyid` or just the algorithm string. (See [Available Algorithms](#available-algorithms))
+`options`   | `object` | optional | `{ algorithm: 'HS256' }` | The options object supporting `algorithm` and `keyid`. (See [Available Algorithms](#available-algorithms))
 
 #### `return`
 Returns token as a `string`.
 
 <hr>
 
-### `jwt.verify(token, secret, [options])`
+### Verify
+#### `jwt.verify(token, secret, [options])`
 
 Verifies the integrity of the token and returns a boolean value.
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 `secret`    | `string` | required | -       | The string which was used to sign the payload.
-`algorithm` | `object`, `string` | optional | `{ algorithm: 'HS256', throwError: false }` | The options object supporting `algorithm` or just the algorithm string. (See [Available Algorithms](#available-algorithms))
+`options`   | `object` | optional | `{ algorithm: 'HS256', skipValidation: false, throwError: false }` | The options object supporting `algorithm`, `skipValidation` and `throwError`. (See [Available Algorithms](#available-algorithms))
+
+#### `throws`
+If `options.throwError` is `true` and the token is invalid, an error will be thrown.
 
 #### `return`
 Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`. 
 
 <hr>
 
-### `jwt.decode(token)`
+### Decode
+#### `jwt.decode(token)`
 
 Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 
 #### `return`
-Returns payload `object`.
+Returns an `object` containing `header` and `payload`:
+```javascript
+{
+    header: {
+        alg: 'HS256',
+        typ: 'JWT'
+    },
+    payload: {
+        name: 'John Doe',
+        email: 'john.doe@gmail.com'
+    }
+}
+```
 
 ### Available Algorithms
  - ES256
@@ -122,4 +147,4 @@ Returns payload `object`.
  - HS512
  - RS256
  - RS384
- - RS512
+ - RS512

index.d.ts

@@ -1,54 +0,0 @@
-/**
- * JWT
- *
- * @class
- * @constructor
- * @public
- */
-declare class JWT {
-
-    /**
-     * Signs a payload and returns the token
-     * 
-     * @param {object} payload The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
-     * @param {string} secret A string which is used to sign the payload.
-     * @param {JWTSignOptions | JWTAlgorithm} options The options object or the algorithm.
-     * @throws {Error} If there's a validation issue.
-     * @returns {Promise<string>} Returns token as a `string`.
-     */
-    sign(payload: object, secret: string, options?: JWTSignOptions | JWTAlgorithm): Promise<string>
-
-    /**
-     * Verifies the integrity of the token and returns a boolean value.
-     * 
-     * @param {string} token The token string generated by `jwt.sign()`.
-     * @param {string} secret The string which was used to sign the payload.
-     * @param {JWTVerifyOptions | JWTAlgorithm} options The options object or the algorithm.
-     * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
-     * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`. 
-     */
-    verify(token: string, secret: string, options?: JWTVerifyOptions | JWTAlgorithm): Promise<boolean>
-
-    /**
-     * Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
-     * 
-     * @param {string} token The token string generated by `jwt.sign()`.
-     * @returns {object | null} Returns payload `object`.
-     */
-    decode(token: string): object | null
-}
-declare const _exports: JWT
-
-type JWTAlgorithm = 'ES256' | 'ES384' | 'ES512' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512'
-
-type JWTSignOptions = {
-    algorithm?: JWTAlgorithm,
-    keyid?: string
-}
-
-type JWTVerifyOptions = {
-    algorithm?: JWTAlgorithm
-    throwError?: boolean
-}
-
-export = _exports

index.js

@@ -1,124 +0,0 @@
-class Base64URL {
-    static parse(s) {
-        return new Uint8Array(Array.prototype.map.call(atob(s.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '')), c => c.charCodeAt(0)))
-    }
-    static stringify(a) {
-        return btoa(String.fromCharCode.apply(0, a)).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
-    }
-}
-
-class JWT {
-    constructor() {
-        if (typeof crypto === 'undefined' || !crypto.subtle)
-            throw new Error('Crypto not supported!')
-        this.algorithms = {
-            ES256: { name: 'ECDSA', namedCurve: 'P-256', hash: { name: 'SHA-256' } },
-            ES384: { name: 'ECDSA', namedCurve: 'P-384', hash: { name: 'SHA-384' } },
-            ES512: { name: 'ECDSA', namedCurve: 'P-512', hash: { name: 'SHA-512' } },
-            HS256: { name: 'HMAC', hash: { name: 'SHA-256' } },
-            HS384: { name: 'HMAC', hash: { name: 'SHA-384' } },
-            HS512: { name: 'HMAC', hash: { name: 'SHA-512' } },
-            RS256: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-256' } },
-            RS384: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-384' } },
-            RS512: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-512' } },
-        }
-    }
-    _utf8ToUint8Array(str) {
-        return Base64URL.parse(btoa(unescape(encodeURIComponent(str))))
-    }
-    _str2ab(str) {
-        const buf = new ArrayBuffer(str.length);
-        const bufView = new Uint8Array(buf);
-        for (let i = 0, strLen = str.length; i < strLen; i++) {
-            bufView[i] = str.charCodeAt(i);
-        }
-        return buf;
-    }
-    _decodePayload(raw) {
-        switch (raw.length % 4) {
-            case 0:
-                break
-            case 2:
-                raw += '=='
-                break
-            case 3:
-                raw += '='
-                break
-            default:
-                throw new Error('Illegal base64url string!')
-        }
-        try {
-            return JSON.parse(decodeURIComponent(escape(atob(raw))))
-        } catch {
-            return null
-        }
-    }
-    async sign(payload, secret, options = { algorithm: 'HS256' }) {
-        if (typeof options === 'string')
-            options = { algorithm: options }
-        if (payload === null || typeof payload !== 'object')
-            throw new Error('payload must be an object')
-        if (typeof secret !== 'string')
-            throw new Error('secret must be a string')
-        if (typeof options.algorithm !== 'string')
-            throw new Error('options.algorithm must be a string')
-        const importAlgorithm = this.algorithms[options.algorithm]
-        if (!importAlgorithm)
-            throw new Error('algorithm not found')
-        payload.iat = Math.floor(Date.now() / 1000)
-        const payloadAsJSON = JSON.stringify(payload)
-        const partialToken = `${Base64URL.stringify(this._utf8ToUint8Array(JSON.stringify({ alg: options.algorithm, kid: options.keyid })))}.${Base64URL.stringify(this._utf8ToUint8Array(payloadAsJSON))}`
-        let keyFormat = 'raw'
-        let keyData
-        if (secret.startsWith('-----BEGIN')) {
-            keyFormat = 'pkcs8'
-            keyData = this._str2ab(atob(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, '')))
-        } else
-            keyData = this._utf8ToUint8Array(secret)
-        const key = await crypto.subtle.importKey(keyFormat, keyData, importAlgorithm, false, ['sign'])
-        const signature = await crypto.subtle.sign(importAlgorithm, key, this._utf8ToUint8Array(partialToken))
-        return `${partialToken}.${Base64URL.stringify(new Uint8Array(signature))}`
-    }
-    async verify(token, secret, options = { algorithm: 'HS256', throwError: false }) {
-        if (typeof options === 'string')
-            options = { algorithm: options }
-        if (typeof token !== 'string')
-            throw new Error('token must be a string')
-        if (typeof secret !== 'string')
-            throw new Error('secret must be a string')
-        if (typeof options.algorithm !== 'string')
-            throw new Error('options.algorithm must be a string')
-        const tokenParts = token.split('.')
-        if (tokenParts.length !== 3)
-            throw new Error('token must consist of 3 parts')
-        const importAlgorithm = this.algorithms[options.algorithm]
-        if (!importAlgorithm)
-            throw new Error('algorithm not found')
-        const payload = this.decode(token)
-        if (payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
-            if (options.throwError)
-                throw 'NOT_YET_VALID'
-            return false
-        }
-        if (payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
-            if (options.throwError)
-                throw 'EXPIRED'
-            return false
-        }
-        let keyFormat = 'raw'
-        let keyData
-        if (secret.startsWith('-----BEGIN')) {
-            keyFormat = 'pkcs8'
-            keyData = this._str2ab(atob(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, '')))
-        } else
-            keyData = this._utf8ToUint8Array(secret)
-        const key = await crypto.subtle.importKey(keyFormat, keyData, importAlgorithm, false, ['sign'])
-        const res = await crypto.subtle.sign(importAlgorithm, key, this._utf8ToUint8Array(tokenParts.slice(0, 2).join('.')))
-        return Base64URL.stringify(new Uint8Array(res)) === tokenParts[2]
-    }
-    decode(token) {
-        return this._decodePayload(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))
-    }
-}
-
-module.exports = new JWT

jest.config.ts

@@ -0,0 +1,9 @@
+import type { Config } from 'jest'
+
+const config: Config = {
+	preset: 'ts-jest',
+	testEnvironment: 'node',
+	verbose: true
+}
+
+export default config

package.json

@@ -1,8 +1,13 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "1.2.0",
+  "version": "2.2.8",
   "description": "A lightweight JWT implementation with ZERO dependencies for Cloudflare Worker",
   "main": "index.js",
+  "types": "index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "jest"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/tsndr/cloudflare-worker-jwt.git"
@@ -19,5 +24,15 @@
   "bugs": {
     "url": "https://github.com/tsndr/cloudflare-worker-jwt/issues"
   },
-  "homepage": "https://github.com/tsndr/cloudflare-worker-jwt#readme"
+  "homepage": "https://github.com/tsndr/cloudflare-worker-jwt#readme",
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20231025.0",
+    "@jest/globals": "^29.7.0",
+    "@types/jest": "^29.5.8",
+    "@types/node": "^20.9.0",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.1.1",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.2.2"
+  }
 }

src/index.spec.ts

@@ -0,0 +1,111 @@
+
+import crypto from 'node:crypto'
+Object.defineProperty(global, 'crypto', { value: { subtle: crypto.webcrypto.subtle }})
+
+import { describe, expect, test } from '@jest/globals'
+import jwt, { JwtAlgorithm } from '.'
+
+type Dataset = {
+    public: string
+    private: string
+    token: string
+}
+
+type Data = {
+    [key in JwtAlgorithm]: Dataset
+}
+
+const data: Data = {
+    'ES256': {
+        public: '-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEVs/o5+uQbTjL3chynL4wXgUg2R9\nq9UU8I5mEovUf86QZ7kOBIjJwqnzD1omageEHWwHdBO6B+dFabmdT9POxg==\n-----END PUBLIC KEY-----',
+        private: '-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgevZzL1gdAFr88hb2\nOF/2NxApJCzGCEDdfSp6VQO30hyhRANCAAQRWz+jn65BtOMvdyHKcvjBeBSDZH2r\n1RTwjmYSi9R/zpBnuQ4EiMnCqfMPWiZqB4QdbAd0E7oH50VpuZ1P087G\n-----END PRIVATE KEY-----',
+        token: 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.Ri9u3ZJpyoHf1_i3KpVE5gMggyU3VMYPeEVktAsG1kGLOxFNJBXydQls3WFBaXXH2-sN74IMe-nDcM7NoJ6GMQ'
+    },
+    'ES384': {
+        public: '-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEC1uWSXj2czCDwMTLWV5BFmwxdM6PX9p+\nPk9Yf9rIf374m5XP1U8q79dBhLSIuaojsvOT39UUcPJROSD1FqYLued0rXiooIii\n1D3jaW6pmGVJFhodzC31cy5sfOYotrzF\n-----END PUBLIC KEY-----',
+        private: '-----BEGIN PRIVATE KEY-----\nMIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCAHpFQ62QnGCEvYh/p\nE9QmR1C9aLcDItRbslbmhen/h1tt8AyMhskeenT+rAyyPhGhZANiAAQLW5ZJePZz\nMIPAxMtZXkEWbDF0zo9f2n4+T1h/2sh/fviblc/VTyrv10GEtIi5qiOy85Pf1RRw\n8lE5IPUWpgu553SteKigiKLUPeNpbqmYZUkWGh3MLfVzLmx85ii2vMU=\n-----END PRIVATE KEY-----',
+        token: 'eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.6nmlvcCpsfENb6ssgX3rJ2XSjpFSXD1RPS1CK0iDZFdi6I6Gnmpi456RSW6-0XSSgq2E2XBcWCSYE6TeI63jOGZJTQ6-65g4sndbzBPqYPWbLny00NQ4MQgQXVu6tRzg'
+    },
+    'ES512': {
+        public: '-----BEGIN PUBLIC KEY-----\nMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBgc4HZz+/fBbC7lmEww0AO3NK9wVZ\nPDZ0VEnsaUFLEYpTzb90nITtJUcPUbvOsdZIZ1Q8fnbquAYgxXL5UgHMoywAib47\n6MkyyYgPk0BXZq3mq4zImTRNuaU9slj9TVJ3ScT3L1bXwVuPJDzpr5GOFpaj+WwM\nAl8G7CqwoJOsW7Kddns=\n-----END PUBLIC KEY-----',
+        private: '-----BEGIN PRIVATE KEY-----\nMIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBiyAa7aRHFDCh2qga\n9sTUGINE5jHAFnmM8xWeT/uni5I4tNqhV5Xx0pDrmCV9mbroFtfEa0XVfKuMAxxf\nZ6LM/yKhgYkDgYYABAGBzgdnP798FsLuWYTDDQA7c0r3BVk8NnRUSexpQUsRilPN\nv3SchO0lRw9Ru86x1khnVDx+duq4BiDFcvlSAcyjLACJvjvoyTLJiA+TQFdmrear\njMiZNE25pT2yWP1NUndJxPcvVtfBW48kPOmvkY4WlqP5bAwCXwbsKrCgk6xbsp12\new==\n-----END PRIVATE KEY-----',
+        token: 'eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.AbRwaCPJM2X3XjE2kInClHVGJNIcpL5C4a1ZrgwEM05RTryyNbazWRFbXAEDtHm8crvXpqw3a8JQwYDwvMyoOr4jAJ4RbhJitLgCGEzhKjvNy4xGrg3dV8gGEShFowgDfVz0KqHOX_Bc_DbyL-gtZPdfGTwT2upLkJE-lj47RStPDh0b'
+    },
+    'HS256': {
+        public: 'secret',
+        private: 'secret',
+        token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.XbPfbIHMI6arZ3Y922BhjWgQzWXcXNrz0ogtVhfEd2o'
+    },
+    'HS384': {
+        public: 'secret',
+        private: 'secret',
+        token: 'eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.hO2sthNQUSfvI9ylUdMKDxcrm8jB3KL6Rtkd3FOskL-jVqYh2CK1es8FKCQO8_tW'
+    },
+    'HS512': {
+        public: 'secret',
+        private: 'secret',
+        token: 'eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.wUVS6tazE2N98_J4SH_djkEe1igXPu0qILAvVXCiO6O20gdf5vZ2sYFWX3c-Hy6L4TD47b3DSAAO9XjSqpJfag'
+    },
+    'RS256': {
+        public: '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n+qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh\nkd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ\n0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg\ncKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc\nmwIDAQAB\n-----END PUBLIC KEY-----',
+        private: '-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC7VJTUt9Us8cKj\nMzEfYyjiWA4R4/M2bS1GB4t7NXp98C3SC6dVMvDuictGeurT8jNbvJZHtCSuYEvu\nNMoSfm76oqFvAp8Gy0iz5sxjZmSnXyCdPEovGhLa0VzMaQ8s+CLOyS56YyCFGeJZ\nqgtzJ6GR3eqoYSW9b9UMvkBpZODSctWSNGj3P7jRFDO5VoTwCQAWbFnOjDfH5Ulg\np2PKSQnSJP3AJLQNFNe7br1XbrhV//eO+t51mIpGSDCUv3E0DDFcWDTH9cXDTTlR\nZVEiR2BwpZOOkE/Z0/BVnhZYL71oZV34bKfWjQIt6V/isSMahdsAASACp4ZTGtwi\nVuNd9tybAgMBAAECggEBAKTmjaS6tkK8BlPXClTQ2vpz/N6uxDeS35mXpqasqskV\nlaAidgg/sWqpjXDbXr93otIMLlWsM+X0CqMDgSXKejLS2jx4GDjI1ZTXg++0AMJ8\nsJ74pWzVDOfmCEQ/7wXs3+cbnXhKriO8Z036q92Qc1+N87SI38nkGa0ABH9CN83H\nmQqt4fB7UdHzuIRe/me2PGhIq5ZBzj6h3BpoPGzEP+x3l9YmK8t/1cN0pqI+dQwY\ndgfGjackLu/2qH80MCF7IyQaseZUOJyKrCLtSD/Iixv/hzDEUPfOCjFDgTpzf3cw\nta8+oE4wHCo1iI1/4TlPkwmXx4qSXtmw4aQPz7IDQvECgYEA8KNThCO2gsC2I9PQ\nDM/8Cw0O983WCDY+oi+7JPiNAJwv5DYBqEZB1QYdj06YD16XlC/HAZMsMku1na2T\nN0driwenQQWzoev3g2S7gRDoS/FCJSI3jJ+kjgtaA7Qmzlgk1TxODN+G1H91HW7t\n0l7VnL27IWyYo2qRRK3jzxqUiPUCgYEAx0oQs2reBQGMVZnApD1jeq7n4MvNLcPv\nt8b/eU9iUv6Y4Mj0Suo/AU8lYZXm8ubbqAlwz2VSVunD2tOplHyMUrtCtObAfVDU\nAhCndKaA9gApgfb3xw1IKbuQ1u4IF1FJl3VtumfQn//LiH1B3rXhcdyo3/vIttEk\n48RakUKClU8CgYEAzV7W3COOlDDcQd935DdtKBFRAPRPAlspQUnzMi5eSHMD/ISL\nDY5IiQHbIH83D4bvXq0X7qQoSBSNP7Dvv3HYuqMhf0DaegrlBuJllFVVq9qPVRnK\nxt1Il2HgxOBvbhOT+9in1BzA+YJ99UzC85O0Qz06A+CmtHEy4aZ2kj5hHjECgYEA\nmNS4+A8Fkss8Js1RieK2LniBxMgmYml3pfVLKGnzmng7H2+cwPLhPIzIuwytXywh\n2bzbsYEfYx3EoEVgMEpPhoarQnYPukrJO4gwE2o5Te6T5mJSZGlQJQj9q4ZB2Dfz\net6INsK0oG8XVGXSpQvQh3RUYekCZQkBBFcpqWpbIEsCgYAnM3DQf3FJoSnXaMhr\nVBIovic5l0xFkEHskAjFTevO86Fsz1C2aSeRKSqGFoOQ0tmJzBEs1R6KqnHInicD\nTQrKhArgLXX4v3CddjfTRJkFWDbE/CkvKZNOrcf1nhaGCPspRJj2KUkj1Fhl9Cnc\ndn/RsYEONbwQSjIfMPkvxF+8HQ==\n-----END PRIVATE KEY-----',
+        token: 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.Eci61G6w4zh_u9oOCk_v1M_sKcgk0svOmW4ZsL-rt4ojGUH2QY110bQTYNwbEVlowW7phCg7vluX_MCKVwJkxJT6tMk2Ij3Plad96Jf2G2mMsKbxkC-prvjvQkBFYWrYnKWClPBRCyIcG0dVfBvqZ8Mro3t5bX59IKwQ3WZ7AtGBYz5BSiBlrKkp6J1UmP_bFV3eEzIHEFgzRa3pbr4ol4TK6SnAoF88rLr2NhEz9vpdHglUMlOBQiqcZwqrI-Z4XDyDzvnrpujIToiepq9bCimPgVkP54VoZzy-mMSGbthYpLqsL_4MQXaI1Uf_wKFAUuAtzVn4-ebgsKOpvKNzVA'
+    },
+    'RS384': {
+        public: '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n+qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh\nkd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ\n0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg\ncKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc\nmwIDAQAB\n-----END PUBLIC KEY-----',
+        private: '-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC7VJTUt9Us8cKj\nMzEfYyjiWA4R4/M2bS1GB4t7NXp98C3SC6dVMvDuictGeurT8jNbvJZHtCSuYEvu\nNMoSfm76oqFvAp8Gy0iz5sxjZmSnXyCdPEovGhLa0VzMaQ8s+CLOyS56YyCFGeJZ\nqgtzJ6GR3eqoYSW9b9UMvkBpZODSctWSNGj3P7jRFDO5VoTwCQAWbFnOjDfH5Ulg\np2PKSQnSJP3AJLQNFNe7br1XbrhV//eO+t51mIpGSDCUv3E0DDFcWDTH9cXDTTlR\nZVEiR2BwpZOOkE/Z0/BVnhZYL71oZV34bKfWjQIt6V/isSMahdsAASACp4ZTGtwi\nVuNd9tybAgMBAAECggEBAKTmjaS6tkK8BlPXClTQ2vpz/N6uxDeS35mXpqasqskV\nlaAidgg/sWqpjXDbXr93otIMLlWsM+X0CqMDgSXKejLS2jx4GDjI1ZTXg++0AMJ8\nsJ74pWzVDOfmCEQ/7wXs3+cbnXhKriO8Z036q92Qc1+N87SI38nkGa0ABH9CN83H\nmQqt4fB7UdHzuIRe/me2PGhIq5ZBzj6h3BpoPGzEP+x3l9YmK8t/1cN0pqI+dQwY\ndgfGjackLu/2qH80MCF7IyQaseZUOJyKrCLtSD/Iixv/hzDEUPfOCjFDgTpzf3cw\nta8+oE4wHCo1iI1/4TlPkwmXx4qSXtmw4aQPz7IDQvECgYEA8KNThCO2gsC2I9PQ\nDM/8Cw0O983WCDY+oi+7JPiNAJwv5DYBqEZB1QYdj06YD16XlC/HAZMsMku1na2T\nN0driwenQQWzoev3g2S7gRDoS/FCJSI3jJ+kjgtaA7Qmzlgk1TxODN+G1H91HW7t\n0l7VnL27IWyYo2qRRK3jzxqUiPUCgYEAx0oQs2reBQGMVZnApD1jeq7n4MvNLcPv\nt8b/eU9iUv6Y4Mj0Suo/AU8lYZXm8ubbqAlwz2VSVunD2tOplHyMUrtCtObAfVDU\nAhCndKaA9gApgfb3xw1IKbuQ1u4IF1FJl3VtumfQn//LiH1B3rXhcdyo3/vIttEk\n48RakUKClU8CgYEAzV7W3COOlDDcQd935DdtKBFRAPRPAlspQUnzMi5eSHMD/ISL\nDY5IiQHbIH83D4bvXq0X7qQoSBSNP7Dvv3HYuqMhf0DaegrlBuJllFVVq9qPVRnK\nxt1Il2HgxOBvbhOT+9in1BzA+YJ99UzC85O0Qz06A+CmtHEy4aZ2kj5hHjECgYEA\nmNS4+A8Fkss8Js1RieK2LniBxMgmYml3pfVLKGnzmng7H2+cwPLhPIzIuwytXywh\n2bzbsYEfYx3EoEVgMEpPhoarQnYPukrJO4gwE2o5Te6T5mJSZGlQJQj9q4ZB2Dfz\net6INsK0oG8XVGXSpQvQh3RUYekCZQkBBFcpqWpbIEsCgYAnM3DQf3FJoSnXaMhr\nVBIovic5l0xFkEHskAjFTevO86Fsz1C2aSeRKSqGFoOQ0tmJzBEs1R6KqnHInicD\nTQrKhArgLXX4v3CddjfTRJkFWDbE/CkvKZNOrcf1nhaGCPspRJj2KUkj1Fhl9Cnc\ndn/RsYEONbwQSjIfMPkvxF+8HQ==\n-----END PRIVATE KEY-----',
+        token: 'eyJhbGciOiJSUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.oPvWzaCp8xUpt5mHhPSn0qLsZfCFj0NVmb4mz4dFQPCCMj-F5zVn9e3zZoj0lIXWM8rxB69QHC3Er47mtDt3BKgysTL3BvvV89kD6UjLoUcAI3lwj0mi7acLoE27i1_TnIBqWNRPAsdvTDawNE0_4lvI5bxEWQCqisJwxCoMDIeJsmDzfyApgU_SAFSVULxXwU2VewaxdQB-41OZdWwUEAxh81iB6DFWrqd2CaJkUYoWjgYpeWsyeC2m_-ECGrHGEz1nKTm9c7BaPxurz7fHD7RJd9Wpx-mKDVsfspO9quWb_OLeGGbxTtAomMvjQjut56kx2fqTleDnNDh_0GE88w'
+    },
+    'RS512': {
+        public: '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n+qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh\nkd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ\n0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg\ncKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc\nmwIDAQAB\n-----END PUBLIC KEY-----',
+        private: '-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC7VJTUt9Us8cKj\nMzEfYyjiWA4R4/M2bS1GB4t7NXp98C3SC6dVMvDuictGeurT8jNbvJZHtCSuYEvu\nNMoSfm76oqFvAp8Gy0iz5sxjZmSnXyCdPEovGhLa0VzMaQ8s+CLOyS56YyCFGeJZ\nqgtzJ6GR3eqoYSW9b9UMvkBpZODSctWSNGj3P7jRFDO5VoTwCQAWbFnOjDfH5Ulg\np2PKSQnSJP3AJLQNFNe7br1XbrhV//eO+t51mIpGSDCUv3E0DDFcWDTH9cXDTTlR\nZVEiR2BwpZOOkE/Z0/BVnhZYL71oZV34bKfWjQIt6V/isSMahdsAASACp4ZTGtwi\nVuNd9tybAgMBAAECggEBAKTmjaS6tkK8BlPXClTQ2vpz/N6uxDeS35mXpqasqskV\nlaAidgg/sWqpjXDbXr93otIMLlWsM+X0CqMDgSXKejLS2jx4GDjI1ZTXg++0AMJ8\nsJ74pWzVDOfmCEQ/7wXs3+cbnXhKriO8Z036q92Qc1+N87SI38nkGa0ABH9CN83H\nmQqt4fB7UdHzuIRe/me2PGhIq5ZBzj6h3BpoPGzEP+x3l9YmK8t/1cN0pqI+dQwY\ndgfGjackLu/2qH80MCF7IyQaseZUOJyKrCLtSD/Iixv/hzDEUPfOCjFDgTpzf3cw\nta8+oE4wHCo1iI1/4TlPkwmXx4qSXtmw4aQPz7IDQvECgYEA8KNThCO2gsC2I9PQ\nDM/8Cw0O983WCDY+oi+7JPiNAJwv5DYBqEZB1QYdj06YD16XlC/HAZMsMku1na2T\nN0driwenQQWzoev3g2S7gRDoS/FCJSI3jJ+kjgtaA7Qmzlgk1TxODN+G1H91HW7t\n0l7VnL27IWyYo2qRRK3jzxqUiPUCgYEAx0oQs2reBQGMVZnApD1jeq7n4MvNLcPv\nt8b/eU9iUv6Y4Mj0Suo/AU8lYZXm8ubbqAlwz2VSVunD2tOplHyMUrtCtObAfVDU\nAhCndKaA9gApgfb3xw1IKbuQ1u4IF1FJl3VtumfQn//LiH1B3rXhcdyo3/vIttEk\n48RakUKClU8CgYEAzV7W3COOlDDcQd935DdtKBFRAPRPAlspQUnzMi5eSHMD/ISL\nDY5IiQHbIH83D4bvXq0X7qQoSBSNP7Dvv3HYuqMhf0DaegrlBuJllFVVq9qPVRnK\nxt1Il2HgxOBvbhOT+9in1BzA+YJ99UzC85O0Qz06A+CmtHEy4aZ2kj5hHjECgYEA\nmNS4+A8Fkss8Js1RieK2LniBxMgmYml3pfVLKGnzmng7H2+cwPLhPIzIuwytXywh\n2bzbsYEfYx3EoEVgMEpPhoarQnYPukrJO4gwE2o5Te6T5mJSZGlQJQj9q4ZB2Dfz\net6INsK0oG8XVGXSpQvQh3RUYekCZQkBBFcpqWpbIEsCgYAnM3DQf3FJoSnXaMhr\nVBIovic5l0xFkEHskAjFTevO86Fsz1C2aSeRKSqGFoOQ0tmJzBEs1R6KqnHInicD\nTQrKhArgLXX4v3CddjfTRJkFWDbE/CkvKZNOrcf1nhaGCPspRJj2KUkj1Fhl9Cnc\ndn/RsYEONbwQSjIfMPkvxF+8HQ==\n-----END PRIVATE KEY-----',
+        token: 'eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.kEZmDAnHHU_0bcGXMd5LA7vF87yQgXNaioPHP4lU4O3JJYuZ54fJdv3HT58xk-MFEDuWro_5fvNIp2VM-PlkZvYWrhQkJ-c-seoSa3ANq_PciC3bGfzYHEdjAE71GrAMI4FlcAGsq3ChkOnCTFqjWDmVwaRYCgMsFQ-U5cjvFhndFMizrkRljTF4v5oFdWytV_J-UafPtNdQXcGND1M74DqObnTHhZHg8aDfNzZcvnIeKcDVGUlUEL5ia1kPMrVhCtOAOJmEU8ivCdWWzt-jMQBf7cZeoCzDKHG72ysTTCfRoBVc1_SrQTHcHDiiBeW9nCazMLkltyP5NeawR_RNlg'
+    }
+
+}
+
+const payload = {
+    sub: "1234567890",
+    name: "John Doe",
+}
+
+describe.each(Object.entries(data) as [JwtAlgorithm, Dataset][])('%s', (algorithm, data) => {
+    let token = ''
+
+    test('verify external', async () => {
+        const verified = await jwt.verify(data.token, data.public, algorithm)
+        expect(verified).toBeTruthy()
+    })
+
+    test('decode external', async () => {
+        const decoded = jwt.decode(data.token)
+        expect({
+            sub: payload.sub,
+            name: payload.name
+        }).toMatchObject({
+            sub: decoded.payload.sub,
+            name: payload.name
+        })
+    })
+
+    test('sign internal', async () => {
+        token = await jwt.sign(payload, data.private, algorithm)
+        expect(token).toMatch(/^[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+$/)
+    })
+
+    test('decode internal', async () => {
+        const decoded = jwt.decode(token)
+        expect({
+            sub: payload.sub,
+            name: payload.name
+        }).toMatchObject({
+            sub: decoded.payload.sub,
+            name: payload.name
+        })
+    })
+
+    test('verify internal', async () => {
+        const verified = await jwt.verify(token, data.public, algorithm)
+        expect(verified).toBeTruthy()
+    })
+})

src/index.ts

@@ -0,0 +1,356 @@
+if (typeof crypto === 'undefined' || !crypto.subtle)
+    throw new Error('SubtleCrypto not supported!')
+
+/**
+ * @typedef JwtAlgorithm
+ * @type {'ES256'|'ES384'|'ES512'|'HS256'|'HS384'|'HS512'|'RS256'|'RS384'|'RS512'}
+ */
+export type JwtAlgorithm = 'ES256'|'ES384'|'ES512'|'HS256'|'HS384'|'HS512'|'RS256'|'RS384'|'RS512'
+
+/**
+ * @typedef JwtAlgorithms
+ */
+export interface JwtAlgorithms {
+    [key: string]: SubtleCryptoImportKeyAlgorithm
+}
+
+/**
+ * @typedef JwtHeader
+ * @prop {string} [typ] Type
+ */
+export interface JwtHeader {
+    /**
+     * Type (default: `"JWT"`)
+     *
+     * @default "JWT"
+     */
+    typ?: string
+
+    [key: string]: any
+}
+
+/**
+ * @typedef JwtPayload
+ * @prop {string} [iss] Issuer
+ * @prop {string} [sub] Subject
+ * @prop {string | string[]} [aud] Audience
+ * @prop {string} [exp] Expiration Time
+ * @prop {string} [nbf] Not Before
+ * @prop {string} [iat] Issued At
+ * @prop {string} [jti] JWT ID
+ */
+export interface JwtPayload {
+    /** Issuer */
+    iss?: string
+
+    /** Subject */
+    sub?: string
+
+    /** Audience */
+    aud?: string | string[]
+
+    /** Expiration Time */
+    exp?: number
+
+    /** Not Before */
+    nbf?: number
+
+    /** Issued At */
+    iat?: number
+
+    /** JWT ID */
+    jti?: string
+
+    [key: string]: any
+}
+
+/**
+ * @typedef JwtOptions
+ * @prop {JwtAlgorithm | string} algorithm
+ */
+export interface JwtOptions {
+    algorithm?: JwtAlgorithm | string
+}
+
+/**
+ * @typedef JwtSignOptions
+ * @extends JwtOptions
+ * @prop {JwtHeader} [header]
+ */
+export interface JwtSignOptions extends JwtOptions {
+    header?: JwtHeader
+}
+
+/**
+ * @typedef JwtVerifyOptions
+ * @extends JwtOptions
+ * @prop {boolean} [throwError=false] If `true` throw error if checks fail. (default: `false`)
+ */
+export interface JwtVerifyOptions extends JwtOptions {
+    /**
+     * If `true` all expiry checks will be skipped
+    */
+    skipValidation?: boolean
+
+    /**
+     * If `true` throw error if checks fail. (default: `false`)
+     *
+     * @default false
+    */
+    throwError?: boolean
+}
+
+/**
+ * @typedef JwtData
+ * @prop {JwtHeader} header
+ * @prop {JwtPayload} payload
+ */
+export interface JwtData {
+    header: JwtHeader
+    payload: JwtPayload
+}
+
+const algorithms: JwtAlgorithms = {
+    ES256: { name: 'ECDSA', namedCurve: 'P-256', hash: { name: 'SHA-256' } },
+    ES384: { name: 'ECDSA', namedCurve: 'P-384', hash: { name: 'SHA-384' } },
+    ES512: { name: 'ECDSA', namedCurve: 'P-521', hash: { name: 'SHA-512' } },
+    HS256: { name: 'HMAC', hash: { name: 'SHA-256' } },
+    HS384: { name: 'HMAC', hash: { name: 'SHA-384' } },
+    HS512: { name: 'HMAC', hash: { name: 'SHA-512' } },
+    RS256: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-256' } },
+    RS384: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-384' } },
+    RS512: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-512' } }
+}
+
+function bytesToByteString(bytes: Uint8Array): string {
+    let byteStr = ''
+    for (let i = 0; i < bytes.byteLength; i++) {
+        byteStr += String.fromCharCode(bytes[i])
+    }
+    return byteStr
+}
+
+function byteStringToBytes(byteStr: string): Uint8Array {
+    let bytes = new Uint8Array(byteStr.length)
+    for (let i = 0; i < byteStr.length; i++) {
+        bytes[i] = byteStr.charCodeAt(i)
+    }
+    return bytes
+}
+
+function arrayBufferToBase64String(arrayBuffer: ArrayBuffer): string {
+    const byteArray = new Uint8Array(arrayBuffer)
+    const byteStr = bytesToByteString(byteArray)
+    return btoa(byteStr)
+}
+
+function base64StringToArrayBuffer(b64str: string): ArrayBuffer {
+    const byteStr = atob(b64str)
+    const bytes = byteStringToBytes(byteStr)
+    return bytes.buffer
+}
+
+function textToArrayBuffer(str: string): ArrayBuffer {
+    const buf = decodeURI(encodeURIComponent(str)) // 2 bytes for each char
+    const bytes = byteStringToBytes(buf)
+    return bytes
+}
+
+// @ts-ignore
+function arrayBufferToText(arrayBuffer: ArrayBuffer): string {
+    const byteArray = new Uint8Array(arrayBuffer)
+    const byteStr = bytesToByteString(byteArray)
+    return byteStr
+}
+
+function arrayBufferToBase64Url(arrayBuffer: ArrayBuffer): string {
+    return arrayBufferToBase64String(arrayBuffer).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
+}
+
+function base64UrlToArrayBuffer(b64url: string): ArrayBuffer {
+    return base64StringToArrayBuffer(b64url.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, ''))
+}
+
+function textToBase64Url(str: string): string {
+    return btoa(str).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
+}
+
+function pemToBinary(pem: string): ArrayBuffer {
+    return base64StringToArrayBuffer(pem.replace(/-+(BEGIN|END).*/g, '').replace(/\s/g, ''))
+}
+
+async function importTextSecret(key: string, algorithm: SubtleCryptoImportKeyAlgorithm): Promise<CryptoKey> {
+    return await crypto.subtle.importKey("raw", textToArrayBuffer(key), algorithm, true, ["verify", "sign"])
+}
+
+async function importJwk(key: JsonWebKey, algorithm: SubtleCryptoImportKeyAlgorithm): Promise<CryptoKey> {
+    return await crypto.subtle.importKey("jwk", key, algorithm, true, ["verify", "sign"])
+}
+
+async function importPublicKey(key: string, algorithm: SubtleCryptoImportKeyAlgorithm): Promise<CryptoKey> {
+    return await crypto.subtle.importKey("spki", pemToBinary(key), algorithm, true, ["verify"])
+}
+
+async function importPrivateKey(key: string, algorithm: SubtleCryptoImportKeyAlgorithm): Promise<CryptoKey> {
+    return await crypto.subtle.importKey("pkcs8", pemToBinary(key), algorithm, true, ["sign"])
+}
+
+async function importKey(key: string | JsonWebKey, algorithm: SubtleCryptoImportKeyAlgorithm): Promise<CryptoKey> {
+    if (typeof key === 'object')
+        return importJwk(key, algorithm)
+
+    if (typeof key !== 'string')
+        throw new Error('Unsupported key type!')
+
+    if (key.includes('PUBLIC'))
+        return importPublicKey(key, algorithm)
+
+    if (key.includes('PRIVATE'))
+        return importPrivateKey(key, algorithm)
+
+    return importTextSecret(key, algorithm)
+}
+
+function decodePayload(raw: string): JwtHeader | JwtPayload | null {
+    switch (raw.length % 4) {
+        case 0:
+            break
+        case 1:
+            raw += '==='
+            break
+        case 2:
+            raw += '=='
+            break
+        case 3:
+            raw += '='
+            break
+        default:
+            throw new Error('Invalid base64url string!')
+    }
+
+    try {
+        return JSON.parse(atob(raw))
+    } catch {
+        return null
+    }
+}
+
+/**
+ * Verifies the integrity of the token and returns a boolean value.
+ *
+ * @param {string} token The token string generated by `jwt.sign()`.
+ * @param {string | JsonWebKey} secret The string which was used to sign the payload.
+ * @param {JWTVerifyOptions | JWTAlgorithm} options The options object or the algorithm.
+ * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
+ * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`.
+ */
+export async function verify(token: string, secret: string | JsonWebKey, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: 'HS256', skipValidation: false, throwError: false }): Promise<boolean> {
+    if (typeof options === 'string')
+        options = { algorithm: options, throwError: false }
+
+    options = { algorithm: 'HS256', skipValidation: false, throwError: false, ...options }
+
+    if (typeof token !== 'string')
+        throw new Error('token must be a string')
+
+    if (typeof secret !== 'string' && typeof secret !== 'object')
+        throw new Error('secret must be a string or a JWK object')
+
+    if (typeof options.algorithm !== 'string')
+        throw new Error('options.algorithm must be a string')
+
+    const tokenParts = token.split('.')
+
+    if (tokenParts.length !== 3)
+        throw new Error('token must consist of 3 parts')
+
+    const algorithm: SubtleCryptoImportKeyAlgorithm = algorithms[options.algorithm]
+
+    if (!algorithm)
+        throw new Error('algorithm not found')
+
+    const { payload } = decode(token)
+
+    if (!options.skipValidation && !payload) {
+        if (options.throwError)
+            throw 'PARSE_ERROR'
+
+        return false
+    }
+
+    if (!options.skipValidation && payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
+        if (options.throwError)
+            throw 'NOT_YET_VALID'
+
+        return false
+    }
+
+    if (!options.skipValidation && payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
+        if (options.throwError)
+            throw 'EXPIRED'
+
+        return false
+    }
+
+    const key = await importKey(secret, algorithm)
+
+    return await crypto.subtle.verify(algorithm, key, base64UrlToArrayBuffer(tokenParts[2]), textToArrayBuffer(`${tokenParts[0]}.${tokenParts[1]}`))
+}
+
+/**
+ * Signs a payload and returns the token
+ *
+ * @param {JwtPayload} payload The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
+ * @param {string | JsonWebKey} secret A string which is used to sign the payload.
+ * @param {JwtSignOptions | JwtAlgorithm | string} [options={ algorithm: 'HS256', header: { typ: 'JWT' } }] The options object or the algorithm.
+ * @throws {Error} If there's a validation issue.
+ * @returns {Promise<string>} Returns token as a `string`.
+ */
+export async function sign(payload: JwtPayload, secret: string | JsonWebKey, options: JwtSignOptions | JwtAlgorithm = 'HS256'): Promise<string> {
+    if (typeof options === 'string')
+        options = { algorithm: options }
+    options = { algorithm: 'HS256', header: { typ: 'JWT' }, ...options }
+
+    if (!payload || typeof payload !== 'object')
+        throw new Error('payload must be an object')
+
+    if (!secret || (typeof secret !== 'string' && typeof secret !== 'object'))
+        throw new Error('secret must be a string or a JWK object')
+
+    if (typeof options.algorithm !== 'string')
+        throw new Error('options.algorithm must be a string')
+
+    const algorithm: SubtleCryptoImportKeyAlgorithm = algorithms[options.algorithm]
+
+    if (!algorithm)
+        throw new Error('algorithm not found')
+
+    if (!payload.iat)
+        payload.iat = Math.floor(Date.now() / 1000)
+
+    const partialToken = `${textToBase64Url(JSON.stringify({ ...options.header, alg: options.algorithm }))}.${textToBase64Url(JSON.stringify(payload))}`
+
+    const key = await importKey(secret, algorithm)
+    const signature = await crypto.subtle.sign(algorithm, key, textToArrayBuffer(partialToken))
+
+    return `${partialToken}.${arrayBufferToBase64Url(signature)}`
+}
+
+/**
+ * Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
+ *
+ * @param {string} token The token string generated by `jwt.sign()`.
+ * @returns {JwtData} Returns an `object` containing `header` and `payload`.
+ */
+export function decode(token: string): JwtData {
+    return {
+        header: decodePayload(token.split('.')[0].replace(/-/g, '+').replace(/_/g, '/')) as JwtHeader,
+        payload: decodePayload(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')) as JwtPayload
+    }
+}
+
+export default {
+    sign,
+    verify,
+    decode
+}

tsconfig.json

@@ -0,0 +1,27 @@
+{
+    "compilerOptions": {
+        "outDir": ".",
+        "module": "esnext",
+        "target": "esnext",
+        "lib": ["esnext"],
+        "declaration": true,
+        "strict": true,
+        "noImplicitAny": true,
+        "strictNullChecks": true,
+        "strictFunctionTypes": true,
+        "strictBindCallApply": true,
+        "strictPropertyInitialization": true,
+        "noImplicitThis": true,
+        "alwaysStrict": true,
+        "noUnusedLocals": true,
+        "noUnusedParameters": true,
+        "noImplicitReturns": true,
+        "noFallthroughCasesInSwitch": true,
+        "esModuleInterop": true,
+        "preserveConstEnums": true,
+        "moduleResolution": "node",
+        "types": ["@cloudflare/workers-types"]
+    },
+    "include": ["src"],
+    "exclude": ["node_modules", "src/**/*.spec.ts"]
+}