JWK
acronymsecuritycryptography
Stands for: JSON Web Key
A JSON format for representing a cryptographic key.
JSON Web Key (RFC 7517) encodes a public or private key as a JSON object, the format signing keys are published in for JWT verification. A collection of them is a JWK Set (JWKS).
A JWK is a cryptographic key expressed as JSON rather than as PEM or DER, which is what makes it convenient for web protocols where everything else is already JSON. The key type field determines which other fields are present: RSA keys carry modulus and exponent, elliptic curve keys carry a curve name and coordinates, symmetric keys carry the key value itself.
The field worth understanding first is the key identifier. It is an arbitrary label whose only job is to let a token say which key signed it, so that a verifier holding several keys can select the right one without trial and error. Rotation depends entirely on this, and a signing key with no identifier forces consumers to try every key they hold, which works until it quietly does not.
The dangerous case is the symmetric key type. A JWK can legitimately carry a private or secret key, so publishing a key set built carelessly from a keystore can expose exactly what it was meant to protect. The rule is that anything served at a public endpoint must contain public halves only, and a quick audit of what your set actually serves is worth doing once rather than discovering the answer from someone else.
Also known as: jwk