Function: generalDecrypt()

September 11, 2026 · View on GitHub

💗 Help the project

Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.

Call Signature

▸ generalDecrypt(jwe, key, options?): Promise<GeneralDecryptResult>

Authenticates and decrypts a general JWE JSON Serialization.

This function is exported (as a named export) from the main 'jose' module entry point as well as from its subpath export 'jose/jwe/general/decrypt'.

Note

Returns plaintext and headers from the first recipient that decrypts successfully. Other recipients may be inspected to enforce serialization rules, but their headers are not included in the result. Rely only on the returned data.

Parameters

Parameter	Type	Description
`jwe`	`GeneralJWE`	General JWE.
`key`	`KeyInput`	Private key or shared secret. See Algorithm Key Requirements.
`options?`	`DecryptOptions`	JWE Decryption options.

Returns

Promise<GeneralDecryptResult>

Example

const jwe = {
  ciphertext: '9EzjFISUyoG-ifC2mSihfP0DPC80yeyrxhTzKt1C_VJBkxeBG0MI4Te61Pk45RAGubUvBpU9jm4',
  iv: '8Fy7A_IuoX5VXG9s',
  tag: 'W76IYV6arGRuDSaSyWrQNg',
  aad: 'VGhlIEZlbGxvd3NoaXAgb2YgdGhlIFJpbmc',
  protected: 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0',
  recipients: [
    {
      encrypted_key:
        'Z6eD4UK_yFb5ZoKvKkGAdqywEG_m0e4IYo0x8Vf30LAMJcsc-_zSgIeiF82teZyYi2YYduHKoqImk7MRnoPZOlEs0Q5BNK1OgBmSOhCE8DFyqh9Zh48TCTP6lmBQ52naqoUJFMtHzu-0LwZH26hxos0GP3Dt19O379MJB837TdKKa87skq0zHaVLAquRHOBF77GI54Bc7O49d8aOrSu1VEFGMThlW2caspPRiTSePDMDPq7_WGk50izRhB3Asl9wmP9wEeaTrkJKRnQj5ips1SAZ1hDBsqEQKKukxP1HtdcopHV5_qgwU8Hjm5EwSLMluMQuiE6hwlkXGOujZLVizA',
    },
  ],
}

const { plaintext, protectedHeader, additionalAuthenticatedData } =
  await jose.generalDecrypt(jwe, privateKey)

console.log(protectedHeader)
const decoder = new TextDecoder()
console.log(decoder.decode(plaintext))
console.log(decoder.decode(additionalAuthenticatedData))

Call Signature

▸ generalDecrypt<KeyType>(jwe, getKey, options?): Promise<GeneralDecryptResult & ResolvedKey<KeyType>>

Authenticates and decrypts a general JWE JSON Serialization with a dynamically resolved key, included in the result.

Type Parameters

Type Parameter	Default type
`KeyType` extends `Uint8Array` \| `CryptoKey`	`Uint8Array` \| `CryptoKey`

Parameters

Parameter	Type	Description
`jwe`	`GeneralJWE`	General JWE.
`getKey`	`GeneralDecryptGetKey`<`KeyType`>	Resolves a private key or shared secret from unverified token data.
`options?`	`DecryptOptions`	JWE Decryption options.

Parameter	Type	Description
`jwe`	`GeneralJWE`	General JWE.
`key`	`KeyInput` \| `GeneralDecryptGetKey`<`Uint8Array` \| `CryptoKey`>	Private key or shared secret, or a function resolving one.
`options?`	`DecryptOptions`	JWE Decryption options.

Returns

Promise<GeneralDecryptResult & Partial<ResolvedKey<Uint8Array | CryptoKey>>>