Cybersecurity glossary
What is a JSON Web Key (JWK)?
Learn what a JSON Web Key (JWK) is, how key parameters are represented in JSON, which key types JWKs support, and how to publish and consume JWKs safely for JWT verification.
Definition
A JSON Web Key (JWK) is a JSON data structure that represents a cryptographic key—public, private, or symmetric—using standardized parameters so applications can publish, discover, and use keys for signing, verifying, encrypting, or decrypting JWT-related material.
Why JSON Web Keys matter
Modern auth stacks distribute verification across many services. Those services need a shared, portable way to describe the keys that sign and encrypt tokens. A JSON Web Key (JWK) fills that gap: cryptographic material expressed as JSON so identity providers, gateways, and APIs can agree on key type, algorithm, and usage without ad-hoc formats.
JWKs sit at the center of JWT ecosystems. Done well, they enable safe key rotation and multi-service verification. Done poorly—with private fields leaked, unconstrained kid lookups, or mismatched algorithms—they become an authenticity failure waiting to happen.
Anatomy of a JWK
kty (key type)
Declares the family of key—RSA, EC, oct, or OKP—so libraries choose the right crypto primitives.
use and key_ops
Hint whether the key is for signature (sig) or encryption (enc), and which operations are allowed.
alg
Optional algorithm intent such as RS256 or ES256; helpful context, not a substitute for server allowlists.
kid
A label used to select among multiple keys during rotation or multi-issuer setups.
Public parameters
Fields such as n/e for RSA or crv/x/y for EC that are safe to publish for verification.
Private / secret fields
Parameters like d or k that must never appear on public JWKS endpoints.
How JWKs are used in practice
Issuer generates key material
An authorization server creates a signing key pair (or encryption keys) under a managed lifecycle.
Public key is serialized as a JWK
Public parameters, kid, and metadata are written into a JWK object.
Key is published for discovery
Often exposed via a JWKS document at a well-known URL for relying parties.
Tokens reference the key
A JWT or JWS header may include kid so verifiers know which JWK to try first.
Verifier loads and constrains the key
The relying party fetches the JWK, checks type and algorithm policy, then verifies.
Rotation retires old keys
New kids are published; old keys remain briefly for in-flight tokens, then are removed.
Public vs private JWK material
| Aspect | Public JWK | Private / symmetric JWK |
|---|---|---|
| Typical fields | n, e or crv, x, y plus metadata | Includes d, p, q, or k |
| Safe to publish? | Yes, for verification and encryption to recipient | No—store in HSM/KMS/secrets only |
| Primary use | Verify signatures or encrypt to the owner | Sign, decrypt, or HMAC |
| Leak impact | Usually low by itself | Immediate token forgery or plaintext recovery risk |
Security practices for JWK handling
- Publish only public JWKs on discovery endpoints; scan responses for accidental private fields.
- Allowlist expected kty and alg combinations on verifiers; never trust header-driven crypto blindly.
- Treat kid as a selector into your own key map—not as a path, URL, or file pointer.
- Prefer short-lived signing keys with planned rotation and overlapping JWKS publication windows.
- Separate signature keys from encryption keys using use/key_ops and operational policy.
- Fetch JWKS over TLS, pin or constrain issuer hosts, and cache with controlled refresh.
- Reject JWKs that claim unsupported curves, weak sizes, or unknown critical (crit) extensions.
- Log kid and key thumbprints in auth telemetry without logging private material.
The practical takeaway
A JSON Web Key (JWK) is the standard JSON representation of a cryptographic key in JOSE and JWT systems. It makes key distribution and rotation workable at scale—but only when public publication, algorithm policy, and kid handling are disciplined.
Treat JWKs as security-critical configuration: publish the minimum, constrain how they are selected, and keep private parameters off the network. For collections of keys and discovery endpoints, continue with JSON Web Key Set (JWKS).
Related security terms
JSON Web Key Set (JWKS)
A JSON document that groups one or more JWKs for key discovery.
JSON Web Signature (JWS)
The signed token format that often relies on JWKs for verification keys.
JSON Web Encryption (JWE)
Encrypted JOSE tokens that use JWKs for encryption and decryption keys.
JWT (JSON Web Token)
A compact claims token commonly verified with keys published as JWKs.
JWT kid Injection
An attack that abuses how key identifiers select JWKs during verification.
Frequently asked questions
What is a JWK in simple terms?
A JWK is a cryptographic key written as a JSON object. Instead of shipping a PEM file alone, services publish fields like key type, algorithm, and key material in a machine-readable format that JWT libraries understand.
Is a JWK the same as a JWKS?
No. A JWK is one key. A JWKS is a set—usually a JSON document with a keys array—that can contain multiple JWKs, often for rotation.
Which key types can a JWK represent?
Common types include RSA (kty: RSA), elliptic curve (kty: EC), octet sequence secrets (kty: oct), and OKP for additional public-key curves depending on profile support.
Should private keys be published in JWKs?
Never on public endpoints. Public JWKs are safe to expose for verification. Private and symmetric key material must stay in secrets stores and be shared only with parties that need to sign or decrypt.
What is the kid parameter?
kid is an optional key identifier that helps verifiers select the correct key when several are available. It must be treated as untrusted input and mapped only to allowlisted keys.
How do JWKs relate to JWT verification?
Resource servers often fetch a JWKS, find the JWK matching the token’s kid or algorithm constraints, and use that public key to verify the signature before trusting claims.
What standards define JWKs?
RFC 7517 defines the JWK format. Related JOSE specs cover JWS, JWE, JWT, and algorithm identifiers used alongside JWK parameters.
References
Explore authoritative guidance and frameworks related to json web key (jwk).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.