How to generate JWT RS256 key

jwtRS256.sh

ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key
# Don't add passphrase
openssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pub
cat jwtRS256.key
cat jwtRS256.key.pub

Thanks a lot. Super helpful.!

like

thank you for this. you saved me.

Thanks for this! If you want to replace all the new lines with literal \n characters you can use the following awk command: awk -v ORS='\\n' '1' jwtRS256.key. It leaves an extra \n at the end of the line though.
https://stackoverflow.com/questions/38672680/replace-newlines-with-literal-n/38674872

It is also possible to just do it with ssh-keygen:

ssh-keygen -t rsa -P "" -b 4096 -m PEM -f jwtRS256.key
ssh-keygen -e -m PEM -f jwtRS256.key > jwtRS256.key.pub

thanks @bentocin, works like a charm!

Many Thanks

It is also possible to just do it with ssh-keygen:

ssh-keygen -t rsa -P "" -b 4096 -m PEM -f jwtRS256.key
ssh-keygen -e -m PEM -f jwtRS256.key > jwtRS256.key.pub

Works great for me! Thanks!

How can i use RS384 algorithm in above command to create rsa public and private key.

It's also possible to generate keys using openssl only:

openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

👍

very thanks

Thanks so much!
I'm sorry I'm still new to this but does the private key go to .gitignore or both the public and private key go to .gitignore?

Thanks so much!
I'm sorry I'm still new to this but does the private key go to .gitignore or both the public and private key go to .gitignore?

To my best knowledge:

Where you put them depends on your secrets management. We don't put either of it in the repo. This information is rather specific to your deployment and can be considered as part of the environment. It is not specific to your application and thus should be treated accordingly.

Depending on your project setup some of the following solutions might be suitable for you:

• GoPass
• KeyPass
• Mozilla SOPS
• HashiCorp Vault
• BitWarden
• 1Password

Another option might be to create them ad-hoc during your deployment.

Hi @bentocin,

Thanks again for the detailed answer, I looked up a few posts on the intenet and you answer makes sense to me now.
I decided to not put either of it in the repo.
Really appreciate your help and solutions!

Cool! 😸

thank you!

Thanks for this! Works nicely!

Perfect, Thanks!

Thank you!!

thank you :))

ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key

thanks so much!!

Thank you so much!

ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key
# Don't add passphrase
openssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pub
cat jwtRS256.key
cat jwtRS256.key.pub

Worked for me! Thank you 🙏

@KenjiFukudome thx

Thank you

Thanks you

Thanks! :)

Thanks so much!

Thanks

Thanks

thanks

Thanks a lot !

thanks

I cannot believe the amount of time and frustration it took to FINALLY stumble upon this amazing post, and the equally amazing comments that provided additional clarity. IMO, while fully acknowledging that the actual generation of public/private keys using openssl/ssh-keygen is beyond scope for node-jsonwebtoken docs, still, it would be a great service to their user base, to if not actually include the few lines required to properly create compatible public/private keys, to at least maybe add references/links to CLEAR, helpful resources LIKE THIS!
Thanks ALOT to the OP, and everyone who contributed!

T. H. A. N. K. S. 🙏

Use this command to convert the keys to one line string

awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}'  jwtRS256.key
awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}'  jwtRS256.key.pub

Thank you indeed!

Thanks

thanks

Thanks！

I think this link resolve also this problem.
https://symfony.com/bundles/LexikJWTAuthenticationBundle/current/index.html
thank you.

Thanks! What if I need to use the private key associated to a Metamask wallet to sign? Can I do it by manipulating the key or do I need another type of key altogether?

Thanks

Thanks!
BTW @ygotthilf you can add -N '' to ssh keygen and it will not even ask for passphrase

awesome!!! Thx

Thanks! Nice and easy!

Awesome, thank youuu

many thanks

save my day, thanks

Thanks

Now, it doesn't work because newer version of ssh-keygen no longer uses PEM format as default key format. It have changed to RFC4716 for default key format. Thus, I have to set PEM format explicitly :

ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key

This will work 👍

In case anyone is getting an error from openssl, try this.

many thanks

thank you good sir!

Thanks :)

nice

oh hell yeah

concise and useful :)

thx

thanks!

Thanks

Thanks!! Amazing!