Generators

JWT Key Generator

Generate cryptographic keys for signing JWTs. For HMAC algorithms (HS256, HS384, HS512), it produces a random secret in hex, base64, and base64url formats. For RSA (RS256, RS384, RS512), ECDSA (ES256, ES384, ES512), and EdDSA (Ed25519), it generates a key pair with both public and private keys in PEM and JWK formats. Includes ready-to-paste code snippets for using the keys with the jose library.

JWT Key Generator — Generate cryptographically secure keys for every JWT algorithm — HMAC, RSA, ECDSA, EdDSA

What it does

  • ▸Generates HMAC secrets for HS256, HS384, HS512 (hex, base64, base64url)
  • ▸Generates RSA key pairs (2048, 3072, 4096 bits) for RS256/384/512 and PS256/384/512
  • ▸Generates ECDSA key pairs (P-256, P-384, P-521 curves) for ES256/384/512
  • ▸Generates Ed25519 key pairs for EdDSA
  • ▸Outputs keys in PEM (SPKI/PKCS8) and JWK formats
  • ▸Provides code snippets for using the keys with jose in Node.js

Use cases

  • ▸Generating an HMAC secret for a new JWT-based auth system
  • ▸Creating RSA key pairs for RS256 JWT signing in production
  • ▸Generating Ed25519 keys for modern, fast JWT signing
  • ▸Getting both PEM and JWK formats for different parts of the same system

How it works

1

Select the JWT algorithm you need (HS256, RS256, ES256, EdDSA, etc.)

2

For RSA, choose the key size (2048, 3072, or 4096 bits)

3

The tool generates the key(s) using the Web Crypto API and jose library

4

Copy the key in the format you need (PEM, JWK, hex, base64)

Frequently asked questions

1Which algorithm should I choose?

HS256 is simplest — a shared secret works for both signing and verification. RS256 is better for distributed systems — the private key signs tokens, and services only need the public key to verify. EdDSA (Ed25519) is the fastest and most modern option with small key sizes.

2What's the difference between PEM and JWK formats?

PEM is the traditional base64-encoded format with headers (-----BEGIN PRIVATE KEY-----). JWK (JSON Web Key) is a JSON-based format used in modern APIs and the jose library. The tool outputs both so you can use whichever your application expects.

3Can I pipe the generated key into the JWT signer?

Yes. The generated HMAC secret flows directly into the JWT tool's secret field via the pipeline. Generate a key, then sign a token with it in one flow. For RSA/ECDSA keys, copy the private key PEM into the JWT tool's signing mode.

Related tools

JWT Debugger — Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

JWT Debugger

Decode JWT tokens, inspect claims, verify signatures, and sign new tokens

Hash Generator — MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Hash Generator

MD5 / SHA / CRC32 / Blake hashes and HMACs of the input text

Certificate Generator — Generate self-signed X.509 certificates with RSA, ECDSA, or Ed25519 keys

Certificate Generator

Generate self-signed X.509 certificates with RSA, ECDSA, or Ed25519 keys

Basic Auth Generator — Build or decode an HTTP Basic Authorization header from user:password

Basic Auth Generator

Build or decode an HTTP Basic Authorization header from user:password

Use JWT Key Generator offline in Devinity

All 95 tools run locally on your Mac. No internet required, no data sent to servers.

Download Devinity →