JWK & JWKS Generator
Generate JSON Web Keys (JWK) and JSON Web Key Sets (JWKS) for OAuth 2.0, OpenID Connect, and JWT signing. Supports RSA (RS256/384/512) and EC (ES256/384/512) — generated entirely in your browser using the Web Crypto API.
How ZeroData protects your privacy
- ✓ No Uploads: Processing happens entirely via client-side JavaScript.
- ✓ No Storage: We do not have a database. We physically cannot save your data.
- ✓ No Tracking: We don't log what you process or track your inputs.
- ✓ Verifiable: Check your DevTools Network tab. You will see 0 outbound requests.
What is a JSON Web Key (JWK) and Why Do You Need One?
A JSON Web Key (JWK) is a standardized JSON format for representing cryptographic keys, defined in RFC 7517. JWKs are the foundation of modern JWT-based authentication systems, OAuth 2.0 authorization servers, and OpenID Connect identity providers. Instead of distributing public keys in PEM format, modern systems expose a JWKS endpoint at /.well-known/jwks.json so token consumers can dynamically retrieve the current public keys for JWT verification.
RSA vs EC vs HMAC Keys — Which to Choose?
- RS256 (RSA): The most widely supported JWT signing algorithm. Use for maximum compatibility with OAuth libraries and identity providers. RSA 2048-bit is safe for most use cases; RS512 with 4096-bit provides long-term security.
- ES256 (EC P-256): Smaller key sizes with equivalent security to RSA 3072-bit. Faster signing and verification. Recommended for new deployments where all consumers support EC keys.
- HS256 (HMAC): Symmetric — the same key is used for signing and verification. Simpler but requires sharing the secret with all token consumers. Not suitable for public API scenarios; use RS256 or ES256 instead.
Using This JWK Generator with Your JWT System
Generate a key pair, copy the Public JWKS and expose it at your /.well-known/jwks.json endpoint. Store the Private JWK securely in your environment variables or secrets manager. Use it with any JWT library that supports JWK import — Node.js jose, Python python-jose, Java nimbus-jose-jwt, and more.
To debug and inspect JWT tokens signed with your new key, use the JWT Debugger. To verify JWT signatures interactively, use the JWT Signature Verifier.
How to Use the JWK & JWKS Generator
- Select the algorithm (RS256, RS384, RS512, ES256, ES384, ES512, HS256, HS384, HS512).
- Set a Key ID (kid) — leave blank to auto-generate a UUID.
- Select the intended use: 'sig' for signing or 'enc' for encryption.
- Click Generate JWK — key generation takes 1–3 seconds.
- Copy the Private JWK (for your signing server) and the Public JWKS (for your /.well-known/jwks.json endpoint).
Common Use Cases
- Generating JWK key pairs for OAuth 2.0 and OpenID Connect authorization servers.
- Creating a JWKS endpoint payload for JWT signature verification by API consumers.
- Generating RS256 or ES256 signing keys for JWT-based authentication systems.
- Testing JWKS-based token verification in development without a live auth server.
- Rotating JWT signing keys by generating new JWKs with unique 'kid' values.
Frequently Asked Questions
What is a JWK and what is a JWKS?
A JSON Web Key (JWK) is a JSON object that represents a cryptographic key. A JSON Web Key Set (JWKS) is a JSON object with a 'keys' array containing one or more JWKs. JWKS endpoints are commonly hosted at /.well-known/jwks.json and used by OAuth 2.0 and OpenID Connect servers so clients can verify JWTs without sharing the private key directly.
Which key types can I generate?
This tool generates RSA key pairs for RS256, RS384, RS512 algorithms; EC key pairs for ES256, ES384, ES512 algorithms; and symmetric keys for HS256, HS384, HS512 algorithms. All generation uses the browser's native Web Crypto API.
What is a Key ID (kid) used for?
The 'kid' (Key ID) claim allows JWT consumers to identify which key to use when validating a token. When a JWT is signed, the 'kid' is included in the header. The consumer fetches the JWKS and finds the matching key by 'kid' to verify the signature. This enables key rotation — you can have multiple keys in your JWKS and retire old ones without breaking existing tokens.
Is it safe to generate JWKs in a browser?
Yes. This tool uses the browser's native Web Crypto API (crypto.subtle) to generate all keys. No key material is ever sent to any server. You can verify this in your browser's DevTools Network tab — zero outbound requests are made during generation.
What is the difference between the public JWKS and the private JWK?
The public JWKS (containing only the public key components) is what you expose at your /.well-known/jwks.json endpoint for JWT consumers to verify tokens. The private JWK (containing the 'd' parameter for RSA, or 'd' for EC) must be kept secret on your server and used only for signing tokens.
Related Tools
JWT Debugger
Inspect JWT headers and payloads locally without leaking tokens to third-party tools.
JWT Expiry Checker
Paste a JWT and instantly see when it expires in your local timezone. No server, no uploads.
JWT Signature Verifier
Verify JWT signatures locally using Web Crypto API. Supports HS256, RS256, and ES256. Your secrets never leave your browser.
HMAC Generator & Verifier
Generate and verify HMAC signatures with SHA-256, SHA-384, SHA-512 using Web Crypto API. Hex and Base64 output — 100% in your browser.