JOSE-JWK-PUB(1)

💅 jose-jwk-pub — like, the jose-jwk-pub(1) era of your life starts now

okay bestie, so this is the jose-jwk-pub page from the jose manual, and it's honestly such a glow-up moment. it's a little tool that strips the private stuff off your keys and leaves you with only the public, share-with-the-world material. main character energy fr fr 🎀

✨ SYNOPSIS ✨

jose jwk pub -i JWK [-o JWK]

that's it. that's the whole vibe. one input, one (optional) output, and boom — public key only 🔥

🌸 OVERVIEW 🌸

so the jose jwk pub command? it removes all private key material from one or more JWK(Set) inputs. all of it. gone. not me being dramatic, that's literally the job 💅

the output will contain only public key material — like, that's the whole point, that's the assignment and it ate.

and there's this cute little detail: if the JWK contains the "key_ops" property, it will be automatically adjusted to include only operations relevant to public keys. so it self-cleans, no manual labor required, obsessed 😭

✨ OPTIONS ✨

• -i JSON, --input=JSON — parse JWK(Set) from JSON. you're just handing it straight-up JSON text, okay bestie? 🌈
• -i FILE, --input=FILE — read JWK(Set) from FILE. like, from actual disk, iconic.
• -i -, --input=- — read JWK(Set) from standard input. yes, the dash is the whole personality here 🫶
• -o FILE, --output=FILE — write JWK(Set) to FILE. put the result somewhere nice.
• -o -, --output=- — write JWK(Set) to standard input. (yes, that's what the page says — copying it exactly, no notes 🙈)
• -s, --set — always output a JWKSet. always. no exceptions, periodt 👑

🦋 EXAMPLES 🦋

clean private key material from a JWK — watch me do it in four lines:

$ jose jwk gen -i '{"alg":"ES256"}' -o prv.jwk
$ cat prv.jwk
{"alg":"ES256","crv":"P-256","key_ops":["sign","verify"],"kty":"EC", ...}
$ jose jwk pub -i prv.jwk -o pub.jwk
$ cat pub.jwk
{"alg":"ES256","crv":"P-256","key_ops":["verify"],"kty":"EC", ...}

see how "sign" just evaporated from "key_ops"? that's the tool doing its thing, and honestly? slay 💜 the "verify" stayed because verify is a public-key activity, iykyk.

💖 AUTHOR 💖

Nathaniel McCallum <npmccallum@redhat.com> — shoutout to the icon who made this 🎀

⭐ SEE ALSO ⭐

jose-alg(1), jose-jwe-enc(1), jose-jwk-exc(1), jose-jwk-gen(1), jose-jwk-thp(1), jose-jwk-use(1), jose-jws-ver(1)

---

okay that's the whole page, bestie! this beauty is JOSE-JWK-PUB(1), dated 06/09/2026, and it's giving "go clean your keys" in the most iconic way possible 🌸💅✨

mwah — go forth and publish responsibly 🧚‍♀️