# @sd-jwt/core

> SD-JWT RFC 9901 implementation in TypeScript

Latest version **0.21.0** (published 2026-09-16) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @sd-jwt/core
pnpm add @sd-jwt/core
yarn add @sd-jwt/core
bun add @sd-jwt/core
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.21.0 |
| Published | 2026-09-16 |
| First published | 2023-11-28 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 1 |
| Unpacked size | 417.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 7 |
| Maintainers | openwalletfoundation |

## Links

- npm: https://www.npmjs.com/package/@sd-jwt/core
- Repository: https://github.com/openwallet-foundation-labs/identity-common-ts
- Homepage: https://github.com/openwallet-foundation-labs/identity-common-ts/tree/main/packages/sd-jwt-core
- Issues: https://github.com/openwallet-foundation-labs/identity-common-ts/issues
- npm.io page: https://npm.io/package/@sd-jwt/core

## Dependencies (1)

- [@owf/identity-common](https://npm.io/package/@owf/identity-common.md) ^0.4.0

## Recent versions

- 0.21.0 (latest) — 2026-09-16
- 0.21.1-alpha-20260922110620 (alpha) — 2026-09-22
- 0.20.2-next.0 (next) — 2026-08-29
- 0.21.1-alpha-20260921121727 — 2026-09-21
- 0.21.1-alpha-20260920163617 — 2026-09-20
- 0.21.1-alpha-20260920143658 — 2026-09-20
- 0.21.1-alpha-20260920133054 — 2026-09-20
- 0.21.1-alpha-20260919211014 — 2026-09-19
- 0.21.1-alpha-20260919112629 — 2026-09-19
- 0.21.1-alpha-20260919100859 — 2026-09-19
- 0.21.1-alpha-20260919094428 — 2026-09-19
- 0.21.1-alpha-20260918081040 — 2026-09-18
- 0.21.1-alpha-20260918080827 — 2026-09-18
- 0.21.1-alpha-20260917172451 — 2026-09-17
- 0.21.1-alpha-20260917125442 — 2026-09-17
- … 223 more at https://npm.io/package/@sd-jwt/core/versions

## README

# @sd-jwt/core

[![npm version](https://img.shields.io/npm/v/@sd-jwt/core)](https://npmjs.com/package/@sd-jwt/core)
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/main/LICENSE)

Core library for [Selective Disclosure for JWTs (SD-JWT) — RFC 9901](https://www.rfc-editor.org/rfc/rfc9901.html).

This package provides types, utilities, encoding/decoding, presentation, and the main `SDJwtInstance` class — everything needed to issue, present, and verify SD-JWTs. For [SD-JWT-based Verifiable Credentials](https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/), use [`@sd-jwt/sd-jwt-vc`](../sd-jwt-vc), which is built on top of this package.

## Installation

```bash
# Using npm
npm install @sd-jwt/core

# Using pnpm
pnpm add @sd-jwt/core

# Using yarn
yarn add @sd-jwt/core
```

## Quick Start

```typescript
import Crypto from 'node:crypto'
import { SDJwtInstance } from '@sd-jwt/core'

// Bring your own crypto – any Signer / Verifier / Hasher that fits the interface
const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519')

const sdjwt = new SDJwtInstance({
  signer: async (data) => {
    const sig = Crypto.sign(null, Buffer.from(data), privateKey)
    return Buffer.from(sig).toString('base64url')
  },
  verifier: async (data, sig) => {
    return Crypto.verify(null, Buffer.from(data), publicKey, Buffer.from(sig, 'base64url'))
  },
  signAlg: 'EdDSA',
  hasher: async (data, alg) => {
    return new Uint8Array(Crypto.createHash(alg.replace('-', '')).update(data).digest())
  },
  hashAlg: 'sha-256',
  saltGenerator: async () => Crypto.randomBytes(16).toString('base64url'),
})

// Issue
const credential = await sdjwt.issue(
  { firstname: 'John', lastname: 'Doe', ssn: '123-45-6789' },
  { _sd: ['firstname', 'lastname', 'ssn'] }
)

// Present (disclose only firstname)
const presentation = await sdjwt.present(credential, { firstname: true })

// Verify
const { payload } = await sdjwt.verify(presentation)
console.log(payload) // { firstname: 'John', ... }
```

## Examples

Runnable examples are available in [`examples/sd-jwt/core`](../../examples/sd-jwt/core). Run them from the repository root:

```bash
pnpm tsx examples/sd-jwt/core/basic.ts
```

See the [SD-JWT examples overview](../../examples/sd-jwt/README.md) for the full list.

## Security

- [x] [Mandatory Signing of the Issuer-signed JWT](https://www.rfc-editor.org/rfc/rfc9901.html#name-mandatory-signing-of-the-is)
- [x] [Manipulation of Disclosures](https://www.rfc-editor.org/rfc/rfc9901.html#name-manipulation-of-disclosures)
- [x] [Entropy of the salt](https://www.rfc-editor.org/rfc/rfc9901.html#name-entropy-of-the-salt)
- [x] [Minimum length of the salt](https://www.rfc-editor.org/rfc/rfc9901.html#name-minimum-length-of-the-salt)
- [x] [Choice of a Hash Algorithm](https://www.rfc-editor.org/rfc/rfc9901.html#name-choice-of-a-hash-algorithm)
- [x] [Key Binding](https://www.rfc-editor.org/rfc/rfc9901.html#name-key-binding)
- [x] [Blinding Claim Names](https://www.rfc-editor.org/rfc/rfc9901.html#name-blinding-claim-names)
- [x] [Selectively-Disclosable Validity Claims](https://www.rfc-editor.org/rfc/rfc9901.html#name-selectively-disclosable-val)
- [x] [Issuer Signature Key Distribution and Rotation](https://www.rfc-editor.org/rfc/rfc9901.html#name-issuer-signature-key-distri)
- [x] [Forwarding Credentials](https://www.rfc-editor.org/rfc/rfc9901.html#name-forwarding-credentials)
- [x] [Integrity of Presentation](https://www.rfc-editor.org/rfc/rfc9901.html#name-integrity-of-presentation)
- [x] [Explicit Typing](https://www.rfc-editor.org/rfc/rfc9901.html#name-explicit-typing)
- [x] [Duplicate Digest Rejection (Section 7.1 step 4)](https://www.rfc-editor.org/rfc/rfc9901.html#section-7.1)
- [x] [Unreferenced Disclosure Rejection (Section 7.1 step 5)](https://www.rfc-editor.org/rfc/rfc9901.html#section-7.1)
- [x] [Claim Name Collision Detection (Section 7.1 step 3c.ii.3)](https://www.rfc-editor.org/rfc/rfc9901.html#section-7.1)

## Platform Support

This library is **platform agnostic** and works in:

- ✅ Node.js (>=20)
- ✅ Browsers (modern browsers with ES2020 support)
- ✅ React Native

A global `TextEncoder` and `TextDecoder` must be available. See the [React Native notes](../identity-common/README.md#react-native) if you need a polyfill.

Cryptographic operations (signing, verification, hashing, salt generation) are provided as callbacks. [`@owf/crypto`](https://github.com/openwallet-foundation-labs/identity-common-ts/tree/main/packages/crypto) provides Web Crypto based implementations.

## Contributing

See the [Contributing Guide](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/main/CONTRIBUTING.md) for details on how to contribute to this project.

## License

This project is licensed under the [Apache License Version 2.0](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/main/LICENSE) (Apache-2.0).

---
_Source: https://npm.io/package/@sd-jwt/core · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._