KEY2JWK(1)

✨ KEY2JWK(1) ✨

okay bestie, welcome to key2jwk, part of the LibJWT C Library — yes, the manual page is literally named KEY2JWK(1) and it's giving key-to-JWK pipeline energy 💅

---

🌸 NAME 🌸

key2jwk — Generate a JSON Web Key Set 🎀

---

🦋 SYNOPSIS 🦋

key2jwk [options] <FILE> [FILE]...

---

✨ DESCRIPTION ✨

okay so. key2jwk Generates a JSON Web Key Set from one or more keys in PEM or DER format. that's the whole job, and it does it flawlessly, no cap 💖

This program will parse PEM/DER key files (public and private) into JSON Web Keys and output a JWK Set. note that HMAC keys are guessed based on them not being parsed by OpenSSL. This may cause some issues 🙈. You can disable this with the -m option. periodt.

HS256, HS384, and HS512 are assumed based on the key size and are expected to be a file with binary data. Using file size in bytes:

• HS256: size >= 32 AND size < 48
• HS384: size >= 48 AND size < 64
• HS512: size >= 64

The -o options is required for output. If the file exists, it will not be overwritten. You can use --output - to write to stdout. If you write to stdout, all other messages will be written to stderr. 💀

RSA keys will not have an algorithm set as they are valid for RS256, RS384, and RS512, however, RSA-PSS keys will be set to PS256, since otherwise they will look no different than an RSA key. RSA keys must be at least 1024 bits. slay.

Private keys will have sign added to the key_ops array while public keys will have the use attribute set to sig. 👑

All keys will get a generated randomized uuidv4 kid attribute unless you use the -k option.

Example output:

$ key2jwk -q -o - eddsa_key_ed25519.pem
{
  "libjwt.io:comment": "Generated by LibJWT 2.9.99",
  "libjwt.io:date": "Sun Jan 12 23:50:24 2025",
  "libjwt.io:hostname": "maClara.local",
  "keys": [
    {
      "key_ops": [
        "sign"
      ],
      "kid": "d74a55b0-631a-4dfb-8842-cecfcb50e728",
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "EdDSA",
      "d": "XY5oUZqGWVZhX7J09hG-rRnAKXiw1g_aBh-Bc52KZ_Y"
    }
  ]
}

🎀 Options 🎀

• -h, --help — Show common options and quit. v helpful of it tbh 🫶
• -l, --list — List all supported algorithms that can be passed to the -a option and quit. window shopping fr fr ✨
• -q, --quiet — Do not output anything except for hard errors (and the JWKS). main character silence 🤫
• -k, --disable-kid — Disable generating kid attribute. no uuid for you 🙈
• -m, --disable-hmac — Disable falling back to HAMC for key files that OpenSSL cannot read. (yes that's how it's spelled in the docs, iykyk 💀)
• -o FILE, --output=FILE — Use FILE to write the JWKS. Use - to write to stdout. 🔥

---

💀 BUGS 💀

See GitHub Issues: https://github.com/benmcollins/libjwt/issues

---

👑 AUTHOR 👑

key2jwk written by Ben Collins bcollins@libjwt.io.

---

🌈 SEE ALSO 🌈

jwt-verify(1), jwt-generate(1), jwk2key(1)

---

and that's the whole page bestie 💖 this one's from the key2jwk User Manual, served fresh out of the LibJWT C Library, filed under KEY2JWK(1). go forth and generate your JWK Sets, you absolute icon 🦋🌸💅