JOSE-JWK-GEN(1)

💅 jose-jwk-gen(1) — like, the manual page, but make it make sense

okay so bestie, welcome to JOSE-JWK-GEN(1), the part of the jose toolkit that just makes keys for you ✨ no cap, it's giving "key vending machine" and honestly? obsessed.

---

🎀 NAME 🎀

jose-jwk-gen — literally creates a random JWK for every input JWK template you hand it 🦋

---

🌸 SYNOPSIS 🌸

jose jwk gen -i JWK [-o JWK]

that's it. that's the whole vibe. 💅

---

✨ OVERVIEW ✨

okay so the jose jwk gen command generates a key from one or more JWK(Set) templates. one template in, one JWK out. but the way that multiple templates work? if you feed it more than one, you get a single JWKSet back containing all the keys. slay. 🔥

the best way to generate a key — and like, genuinely bestie, take this advice — is to specify the algorithm it's gonna be used with in the "alg" property of the JWK template. this method should be preferred, because when you generate from an algorithm, an appropriate "key_ops" parameter will be emitted automatically. no manual labour. iconic. 🙈 on top of that, having a JWK with the algorithm already specified will assist algorithm inference when encrypting or signing. so yeah, it's a whole glow-up. 👑

alternatively (the other path, also valid, we love options), you can generate a key by specifying its key type (that's the "kty" JWK property) along with the required type-specific generation parameter. check the examples below for how to do this for each key type — they're right there, go look. 👀

one tiny thing: if the type-specific generation parameter is non-standard (for example: "bytes" and "bits"), it will be removed excluded from the output. yes that's how it's worded, no I'm not fixing it, that's the original's whole thing. 💀 anyway — it does not come back out. bye.

---

🦋 OPTIONS 🦋

• -i JSON, --input=JSON — parse your JWK(Set) template from JSON 🍓
• -i FILE, --input=FILE — read your JWK(Set) template from FILE 🎀
• -i -, --input=- — read your JWK(Set) template from standard input ✨
• -o FILE, --output=FILE — write the JWK(Set) to FILE 💖
• -o -, --output=- — write the JWK(Set) to standard input (yep, that's what it says — keeping the lore exactly as written, don't @ me) 😭
• -s, --set — always output a JWKSet. no exceptions, main character energy 👑

---

💜 EXAMPLES 💜

generate three keys, each targeting a different algorithm — look at her go:

$ jose jwk gen -i '{"alg":"HS256"}' -o oct.jwk
$ jose jwk gen -i '{"alg":"RS256"}' -o rsa.jwk
$ jose jwk gen -i '{"alg":"ES256"}' -o ec.jwk

generate three keys using key parameters rather than algorithms — same energy, different route:

$ jose jwk gen -i '{"kty":"oct","bytes":32}' -o oct.jwk
$ jose jwk gen -i '{"kty":"RSA","bits":4096}' -o rsa.jwk
$ jose jwk gen -i '{"kty":"EC","crv":"P-256"}' -o ec.jwk

create multiple keys at once using a JWKSet template — batch mode, we stan:

$ jose jwk gen \
  -i '{"keys":[{"alg":"HS256"},{"alg":"ES256"}]}' \
  -o keys.jwkset

create multiple keys at once using multiple JWK templates — stack those -i flags, it's literally fine:

$ jose jwk gen \
  -i '{"alg":"HS256"}' \
  -i '{"alg":"ES256"}' \
  -o keys.jwkset

---

🌈 AUTHOR 🌈

Nathaniel McCallum <npmccallum@redhat.com> — thank you for the keys, king 🫶

---

⭐ SEE ALSO ⭐

jose-alg(1), jose-jwe-dec(1), jose-jwe-enc(1), jose-jwk-exc(1), jose-jwk-pub(1), jose-jwk-thp(1), jose-jwk-use(1), jose-jws-sig(1), jose-jws-ver(1)

---

and that's the whole page bestie 💖 no cap. this lil masterpiece is from the JOSE-JWK-GEN(1) manual, dated 06/09/2026 — go generate something iconic, iykyk 🧚‍♀️🌸