JWK Generator
Generate RSA (RS256) or EC (ES256) JSON Web Key pairs entirely in your browser via the Web Crypto API.
—
—
What is a JWK?
A JSON Web Key (JWK) is a standardized JSON structure (RFC 7517) representing a cryptographic key — RSA, EC, or symmetric. Multiple JWKs are typically bundled into a JWKS ("JSON Web Key Set") document, published at a well-known URL so that any service can fetch the public keys needed to verify JWTs signed with RS256, ES256, and similar asymmetric algorithms.
How it works
This tool calls crypto.subtle.generateKey() to create an asymmetric key pair (RSASSA-PKCS1-v1_5 with a 2048-bit modulus, or ECDSA on curve P-256), then crypto.subtle.exportKey('jwk', key) to serialize each key as a JWK. A random Key ID (kid) is attached to both keys so they can be matched together in a JWKS rotation scheme.
Worked example
Generate an EC key pair, keep the private JWK on your authorization server to sign ES256 JWTs, and publish the public JWK at /.well-known/jwks.json wrapped as {"keys": [publicJwk]}. Resource servers fetch that endpoint, find the key matching the token's kid header, and verify the signature — no shared secret required.
Common mistakes
- Accidentally publishing the private JWK instead of the public one on a JWKS endpoint.
- Forgetting to set the correct
algheader (RS256 vs ES256) when signing, causing verifier mismatches. - Not rotating keys periodically, or removing an old public key before all tokens signed with it have expired.
- Using RSA with a modulus smaller than 2048 bits, which is considered insufficiently secure today.
Security notes
Both keys are generated and exported entirely in your browser — nothing is transmitted to a server. Still, treat the private JWK exactly like a private key file: store it in a secrets manager, never commit it to source control, and regenerate a new pair if you suspect exposure.
Code examples
const pair = await crypto.subtle.generateKey(
{ name: "ECDSA", namedCurve: "P-256" },
true,
["sign", "verify"]
);
const publicJwk = await crypto.subtle.exportKey("jwk", pair.publicKey);import { generateKeyPair, exportJWK } from "jose";
const { publicKey, privateKey } = await generateKeyPair("ES256");
const publicJwk = await exportJWK(publicKey);JWK Generator FAQ
What is a JWK?
A JSON Web Key (JWK, RFC 7517) is a JSON representation of a cryptographic key — public, private, or symmetric. It's the standard format for exchanging RS256/ES256 public keys via a JWKS endpoint for JWT verification.
Which algorithm should I choose, RSA or EC?
EC (P-256, used with ES256) produces much smaller keys and signatures for equivalent security, and is faster to generate. RSA (used with RS256) is more widely supported by legacy systems and libraries.
Is the private key safe to share?
No. Only share the public key (or public JWK) with parties that need to verify your tokens. Keep the private key secret — treat it like a password.
How do I use this for RS256/ES256 JWTs?
Sign JWTs on your server with the private key, and publish the public JWK (often via a /.well-known/jwks.json endpoint) so clients or other services can verify signatures without sharing the private key.
Does key generation happen on a server?
No — this tool uses the browser's native Web Crypto API (crypto.subtle.generateKey and exportKey) entirely client-side. Keys are never transmitted anywhere.
What does the 'kid' field mean?
The Key ID (kid) header lets a JWT indicate which key from a JWKS set was used to sign it, enabling key rotation without breaking verification for tokens signed by older keys.