Encrypt your JWTs in .NET, not just sign them

Guillermo Contreras — Fri, 10 Jul 2026 01:51:52 +0000

A signed JWT (JWS) is tamper-proof, but it's not private — paste one into
jwt.io and you'll read every claim. If your token carries an email, a role or any
PII, you want it encrypted (JWE). Here's how, with
Matios.Security — dependency-free JOSE/JWT for
.NET, MIT.

Install

dotnet add package Matios.Security

First, a normal signed token (JWS)

using Matios.Security.Jose;
using Matios.Security.Jwt;

var signingKey = SymmetricJoseKey.FromBase64Url(signingKeyB64, "sig-2026");

string token = new JwtBuilder()
    .Issuer("my-platform")
    .Subject(userId)
    .Lifetime(TimeSpan.FromMinutes(30))
    .Claim("role", "admin")
    .SignWith(signingKey)
    .Create();

Integrity: ✅. Confidentiality: ❌ — the payload is just base64, readable by anyone
who intercepts it.

Now encrypt it — one extra line

Add .EncryptWith(...) and the same builder produces a Nested JWT (signed
inside, encrypted outside). The token becomes opaque — dir + A256GCM:

string token = new JwtBuilder()
    .Subject(userId)
    .Lifetime(TimeSpan.FromMinutes(30))
    .Claim("role", "admin")
    .Claim("email", "ana@acme.cl")
    .SignWith(signingKey)
    .EncryptWith(encryptionKey)      // ← now the claims are hidden
    .Create();

(Fun fact: Microsoft's own stack can't even issue a JWE with A256GCM — this
library does, cross-platform.)

Validate — strict by design

JwtClaims claims = JwtValidator.Validate(token, new JwtValidationParameters
{
    SigningKey    = signingKey,
    DecryptionKey = encryptionKey,   // set ⇒ a plain JWS is rejected (no downgrade)
    ValidIssuer   = "my-platform"
});

string role = claims.GetClaim<string>("role");

You declare the accepted alg/enc — no alg:"none", no algorithm confusion,
crit/zip rejected. Validation failures raise one generic error; the real reason
stays in a log-only failure code (anti-oracle).

Docs and examples → https://security.matios.cl. Part of a
family of zero-dependency, MIT packages for .NET — matios.cl.

If you try it, I'd love your feedback — issues and stars welcome. 🙌

I built five zero-dependency packages for .NET

Guillermo Contreras — Fri, 10 Jul 2026 01:42:08 +0000

For the last few months I've been building Matios — a small family of
open-source packages for .NET (and the web) that all share one rule:
zero dependencies.

Not "few dependencies." Zero. Each one is built only on the BCL — no third-party
packages, no transitive tree to audit, nothing that can change its license out
from under you. MIT, and small enough to read end to end.

Here's why, and what's in the family.

Why zero dependencies?

Every dependency you add is something you don't fully control: a supply-chain
surface, a transitive tree, a maintenance and licensing risk. For a lot of
everyday tasks — writing an Excel file, generating a PDF, dispatching a request —
I wanted a library I could drop in and forget, and read if I ever needed to.

So instead of wrapping an existing engine, each package writes the format (or
implements the pattern) itself, on the BCL alone. As a bonus, that makes them a
great fit for Native AOT and trimming, where every dependency is friction.

The family

📊 Matios.Spreadsheet — read, write and stream
.xlsx (Office Open XML) with its own engine: styling, formulas computed in
memory, charts, pivots, streaming.

📄 Matios.Pdf — generate, read and encrypt PDFs
(ISO 32000): embedded, subsetted Unicode fonts, vector graphics, images, and a
layout engine with flow and paginating tables.

🧩 Matios.Forge — a mediator for .NET with no
mandatory container (dispatch in ~15 ns, allocation-free), plus a set of building
blocks for Clean Architecture (specification, state machine, strategy, repository…).

🔒 Matios.Security — JOSE/JWT done strictly: it
issues JWE (encrypted tokens) that the official .NET stack can't, plus JWS and
Nested JWT.

🎨 Matios UI Framework — the web sibling:
UI in pure CSS and JavaScript, 85+ components, mode + accent theming, no build step.

Every one is MIT, tested and benchmarked — and, for the .NET ones, validated
against real readers (opening the .xlsx in Excel, the PDF in real viewers, and
so on) rather than just unit tests in isolation.

Try them

Each has its own page with the docs, examples, benchmarks and the install command
(plus NuGet and GitHub links):

Or start from matios.cl.

It's early, and it's open source. If any of these solve a problem for you, I'd
genuinely love your feedback — issues, stars, and "this broke on my file" reports
are all welcome. That's exactly how they get better.

I'll follow up with a short how-to for each one. Thanks for reading. 🙌

DEV Community: Guillermo Contreras