JSON Web Key Generator: Real Keys, Standard JWK Format
A JWK (JSON Web Key) is how JWT libraries and JWKS endpoints represent cryptographic keys as plain JSON — standardized fields for the key type, intended algorithm, and the key material itself. This tool generates real RSA, EC, or HMAC keys using the browser's native Web Crypto API and exports them directly in RFC 7517 JWK format, ready to drop into a JWT library or a local JWKS file for development.
Public JWKs are safe to share; private/symmetric JWKs must be kept secret.
Choosing Between EC, RSA, and HMAC
EC P-256 (algorithm ES256) produces much smaller keys and signatures than RSA at an equivalent security level, and is the modern recommended default for new systems. RSA 2048-bit (RS256) remains extremely widely supported, including by older systems that don't support EC. HMAC (HS256) is symmetric — the same secret signs and verifies, so it only makes sense when the signer and verifier are the same party (unlike RSA/EC, where you can safely give out the public key for verification).
Why JWK Instead of PEM
PEM is the traditional text format for keys (base64 wrapped in -----BEGIN/END----- markers), designed for older cryptographic tooling. JWK is a JSON-native format designed specifically for the JOSE (JSON Object Signing and Encryption) ecosystem — JWTs, JWS, JWE — making it the natural choice when your keys are primarily used with JWT libraries rather than traditional PKI tooling.
Public vs. Private/Symmetric JWK
For RSA and EC keys, this tool generates both a public JWK (safe to publish, e.g. in a JWKS endpoint for others to verify your tokens) and a private JWK (must stay secret, used to sign). For the HMAC option, there's only one symmetric JWK, since the same key is used for both signing and verification and must be shared secretly between exactly the parties that need it.
Practical Examples
Generating a Modern Signing Key
EC P-256 for a new JWT-based system.
- 1.Key Type: EC — P-256 (ES256)
- 2.Private JWK: sign new tokens
- 3.Public JWK: publish for verifiers
Generating a Development HMAC Secret
Symmetric signing for local testing.
- 1.Key Type: HMAC — 256-bit
- 2.Single JWK: used for both signing and verifying in dev
Key Types Supported
- EC P-256 / P-384: ES256 / ES384 signing
- RSA 2048 / 4096-bit: RS256 signing
- HMAC 256-bit: HS256 symmetric signing
Good Use Cases
- Generating development/test keys for a JWT-based auth system
- Building a local JWKS endpoint for testing
- Learning the JWK format's structure for a given key type
- Quickly generating a real key pair without installing a CLI tool
Frequently Asked Questions
What is a JWK?
A JSON Web Key (RFC 7517) is a JSON representation of a cryptographic key — public, private, or symmetric — with standardized fields like kty (key type), alg (algorithm), and the key material itself, base64url-encoded. It's the format JWT signing/verification libraries and JWKS endpoints commonly use.
Which key type should I choose for JWT signing?
EC P-256 (ES256) is a strong, fast, compact modern default. RSA 2048-bit (RS256) is still extremely common for compatibility with older systems and services that specifically expect RSA. HMAC (HS256) is for symmetric signing, where the same secret both signs and verifies — appropriate only when signer and verifier are the same trusted party.
Is this actually generating real cryptographic keys?
Yes — key generation uses the browser's native Web Crypto API (crypto.subtle.generateKey), the same underlying implementation used by production web applications, not a simulated or placeholder key.
What's the difference between the public and private JWK?
For asymmetric keys (RSA, EC), the public JWK contains only the public key components — safe to share, used for verifying signatures. The private JWK contains the private key material and must be kept secret; treat it exactly like a private key file.
Can I use the generated key directly with a JWT library?
Yes — most JWT libraries (jsonwebtoken, jose, etc.) accept JWK-format keys directly, or can import them, making this a convenient way to generate test/development keys without a separate CLI tool.
Is my generated key sent anywhere?
No, key generation and JWK export both happen entirely in your browser via the Web Crypto API — private key material never leaves your device.