JWK / JWKS Generator

Generate JWK and JWKS key sets for RS256, ES256, ES512, HS256, and HS512.

Runs in your browser — your data never leaves your device

JWK Generation Options

Algorithm

RSA Modulus Length

Generate JSON Web Key (JWK) and JSON Web Key Set (JWKS) pairs for use with JWT signing, OIDC discovery endpoints, and API authentication. All keys are generated entirely in your browser using the Web Crypto API — nothing is sent to any server.

What is a JWK?

A JSON Web Key (JWK) is a JSON-based format for representing cryptographic keys. It is defined in RFC 7517 and is commonly used to distribute public keys for verifying JSON Web Tokens (JWTs). A JSON Web Key Set (JWKS) is a JSON object that contains an array of JWKs, typically exposed via a /.well-known/jwks.json endpoint for OIDC providers and API gateways.

Supported Algorithms

RS256 — RSA PKCS#1 v1.5 with SHA-256. The most widely used asymmetric algorithm for JWT signing. Requires a key pair (public + private). RSA-2048 is the minimum recommended size.

ES256 — ECDSA with P-256 curve and SHA-256. Provides the same security as RSA-3072 with much smaller key sizes. Ideal for mobile and resource-constrained environments.

ES512 — ECDSA with P-521 curve and SHA-512. The strongest ECDSA option, offering approximately 256-bit security. Use when maximum asymmetric security is required without the overhead of large RSA keys.

HS256 — HMAC with SHA-256. A symmetric algorithm that uses a single shared secret key. Simpler and faster than asymmetric algorithms but requires secure key distribution.

HS512 — HMAC with SHA-512. Same symmetric model as HS256 but with a stronger hash function. Recommended when the highest HMAC security is needed and key distribution is already handled.

When to Use JWKS?

JWKS endpoints are used by identity providers (Auth0, Okta, AWS Cognito) to publish their signing keys. Clients fetch the JWKS to verify tokens without hardcoding secrets. Use this tool to generate test keys, prototype authentication flows, or set up custom OIDC providers. The generated public JWK can be published at your /.well-known/jwks.json endpoint.

Frequently Asked Questions

What is a JWK?

A JSON Web Key (JWK) is a JSON-based format for representing cryptographic keys, defined in RFC 7517. It is commonly used to distribute public keys for verifying JSON Web Tokens (JWTs).

What is a JWKS?

A JSON Web Key Set (JWKS) is a JSON object containing an array of JWKs. Identity providers expose these at a /.well-known/jwks.json endpoint so clients can verify tokens without hardcoding secrets.

Which algorithm should I choose?

RS256 is the most widely supported and commonly used. ES256 offers equivalent security with smaller keys, making it ideal for constrained environments. ES512 provides the strongest ECDSA option. HS256 and HS512 are simpler and faster symmetric algorithms but require secure key distribution between signer and verifier.

Are my keys kept private?

Yes. All key generation happens entirely in your browser using the Web Crypto API. No data is ever sent to any server.

Is this tool free?

Yes, ToolDock's JWK/JWKS generator is completely free, requires no signup, and runs entirely in your browser.

RSA Key Generator

Generate public and private RSA key pairs.

JWT Encoder/Decoder

Encode and decode JSON Web Tokens.

Hash Generator

Generate hashes (MD5, SHA-1, SHA-256, etc.).

What is a JWK?

Supported Algorithms

When to Use JWKS?

Frequently Asked Questions

What is a JWK?

What is a JWKS?

Which algorithm should I choose?

Are my keys kept private?

Is this tool free?

Related Tools

What is a JWK?

Supported Algorithms

When to Use JWKS?