Skip to content
ecdsa.com

JWK (JSON Web Key)

The JSON representation of a cryptographic key defined in RFC 7517, with members such as kty, crv, x, y, n and e for public keys and d for the private part.
Also written asJSON Web KeyRFC 7517kty

Key types (kty): EC with crv (P-256, P-384, P-521, secp256k1), x and y; RSA with n and e (and d, p, q, dp, dq, qi for private keys); OKP (RFC 8037) with crv Ed25519, Ed448, X25519 or X448 and x; oct with k for symmetric keys. Values are base64url-encoded big-endian integers or byte strings; coordinates are fixed-length (32 bytes for P-256), so stripping leading zero bytes breaks keys.

Optional metadata: kid, alg (pins the key to one algorithm), use (sig or enc), key_ops, and x5c or x5t#S256 links to certificates. A private JWK contains d; never publish it, and strip it before putting a key into a JWKS. This site's tools reject JWKs with d wherever only a public key is needed.

Conversions to and from PEM are lossless for the key material; node:crypto (createPublicKey and export with format: "jwk"), WebCrypto's jwk import and export, and the JWK converter do it.

Standards and references

All terms