Introduction
A JSON Web Key (JWK) is a JSON object that represents a cryptographic key, defined in RFC 7517. JWKs are the native key format for JSON Web Signatures (JWS), JSON Web Encryption (JWE), and JSON Web Tokens (JWT), and they are the format returned by the WebCrypto API's `exportKey` function. This tool generates JWK key pairs for common JWT algorithms and parses existing JWKs to validate them and compute their RFC 7638 thumbprint, entirely in your browser via WebCrypto.
What this tool does
- Generates JWK key pairs for RS256/384/512, PS256/384/512, ES256/384/512, and EdDSA.
- Exports both the public and private JWK as formatted JSON, ready to paste into a JWKS endpoint.
- Computes the RFC 7638 thumbprint of any generated or pasted JWK.
- Parses and validates a pasted JWK, reporting kty, alg, use, kid, and key_ops.
- Processes all data locally in your browser with no network requests.
How this tool works
Pick an algorithm and click Generate. The tool calls the jose library's `generateKeyPair` with the WebCrypto API, exports the public and private keys as JWKs via `exportJWK`, and computes the RFC 7638 thumbprint via `calculateJwkThumbprint`. To parse an existing JWK, paste it into the parser textarea; the tool validates the JSON, computes the thumbprint, and displays the key parameters. All computation runs client-side.
How JSON Web Keys work
RFC 7517 (2015) defines the JWK format: a JSON object with a `kty` (key type) member such as `RSA`, `EC`, `OKP`, or `oct`, plus type-specific members (`n` and `e` for RSA, `crv`, `x`, `y` for EC, `crv`, `x` for OKP, `k` for oct). Optional members include `alg` (algorithm), `use` (sig or enc), `kid` (key ID), and `key_ops` (allowed operations). RFC 7638 (2015) defines the JWK thumbprint: the SHA-256 hash of the canonical JSON containing only the required members in lexicographic order, base64url-encoded. The thumbprint is commonly used as the `kid` in JWKS endpoints so that a JWT header's `kid` references a specific key. The jose library used by this tool is a pure JavaScript implementation that relies on the WebCrypto API for the actual key generation and export.
How to use this tool
- Pick an algorithm (e.g. ES256 for ECDSA P-256, RS256 for RSA-2048, EdDSA for Ed25519).
- Click Generate key pair. The public and private JWKs appear as formatted JSON.
- Copy the public JWK to your JWKS endpoint, or the private JWK to your signing service.
- To parse an existing JWK, paste it into the parser textarea.
- The tool validates the JSON, shows the key parameters, and computes the RFC 7638 thumbprint.
Real-world examples
Generating an ES256 key pair
Algorithm: ES256. The public JWK has `kty: EC`, `crv: P-256`, and base64url `x` and `y` coordinates. The private JWK adds a base64url `d` scalar. The thumbprint is the RFC 7638 SHA-256 of `{crv, kty, x, y}`.
Generating an RSA key pair
Algorithm: RS256. The public JWK has `kty: RSA`, base64url `n` (modulus) and `e` (exponent). The private JWK adds `d`, `p`, `q`, `dp`, `dq`, and `qi`. RSA keys are larger than EC keys for equivalent security.
Parsing a pasted JWK
Paste a JWK JSON object into the parser. The tool shows badges for kty, alg, use, kid, and key_ops, and computes the thumbprint. Invalid JSON or a missing `kty` produces a clear error.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| JWK (RFC 7517) | O(n) — JSON parse | JWT, JWS, JWE, JWKS endpoints, WebCrypto |
| PEM (RFC 7468) | O(n) — base64 + DER | TLS, OpenSSL, config files |
| OpenSSH | O(n) — custom binary | SSH authorized_keys, known_hosts |
| COSE (RFC 8152) | O(n) — CBOR | Constrained devices, WebAuthn |
Limitations or considerations
This tool generates extractable keys so that the JWK can be exported; in production you may want non-extractable keys for added safety. The parser computes the RFC 7638 thumbprint but does not verify that the key parameters are mathematically consistent (e.g. that an EC public point lies on the curve). Symmetric `oct` keys are not generated here; use the Random String Generator tool for that. Never paste a production private key into any online tool; this tool runs entirely in your browser, but you should still treat private keys as sensitive.
Frequently asked questions
What is a JWK thumbprint?
It is the SHA-256 hash of the canonical JSON containing only the required JWK members in lexicographic order, base64url-encoded. It is defined in RFC 7638 and commonly used as the `kid` in JWKS endpoints.
Which algorithm should I pick?
For new JWT signing, EdDSA (Ed25519) is the smallest and fastest. ES256 (ECDSA P-256) is the most widely supported. RS256 (RSA-2048) is the most compatible with legacy systems. Avoid RS256 for new designs if you can use EC or Ed25519.
Can I generate a symmetric key here?
No. This tool generates asymmetric key pairs. For a symmetric `oct` key, use the Random String Generator tool on this site and base64url-encode the result.
Is it safe to paste a private JWK into the parser?
The parser runs entirely in your browser and sends no data to any server, but you should still treat private keys as sensitive. For production keys, prefer a local tool or your runtime's key management service.
Conclusion
The JWK generator and parser gives you a fast, browser-based way to produce JSON Web Keys for JWT signing and to validate existing JWKs with their RFC 7638 thumbprints. With support for RSA, ECDSA, and Ed25519 algorithms and a fully client-side implementation via WebCrypto, it is a handy tool for JWT developers and anyone working with JWKS endpoints.