[{"data":1,"prerenderedAt":1395},["ShallowReactive",2],{"navigation":3,"-jwk-generating":167,"-jwk-generating-surround":1392},[4,22,78,106,141,148],{"title":5,"path":6,"stem":7,"children":8},"Introduction","\u002Fgetting-started","0.Getting-Started\u002F0.index",[9,10,14,18],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13},"Installation","\u002Fgetting-started\u002Finstallation","0.Getting-Started\u002F1.installation",{"title":15,"path":16,"stem":17},"Quickstart","\u002Fgetting-started\u002Fquickstart","0.Getting-Started\u002F2.quickstart",{"title":19,"path":20,"stem":21},"Core concepts","\u002Fgetting-started\u002Fcore-concepts","0.Getting-Started\u002F3.core-concepts",{"title":23,"path":24,"stem":25,"children":26,"icon":28},"JWT","\u002Fjwt","1.JWT\u002F0.index",[27,29,52],{"title":23,"path":24,"stem":25,"icon":28},"i-carbon-certificate",{"title":30,"path":31,"stem":32,"children":33,"icon":35},"JWS","\u002Fjwt\u002Fjws","1.JWT\u002F1.JWS\u002F0.index",[34,36,40,44,48],{"title":30,"path":31,"stem":32,"icon":35},"i-carbon-document-signed",{"title":37,"path":38,"stem":39},"Signing","\u002Fjwt\u002Fjws\u002Fsigning","1.JWT\u002F1.JWS\u002F1.signing",{"title":41,"path":42,"stem":43},"Verifying","\u002Fjwt\u002Fjws\u002Fverifying","1.JWT\u002F1.JWS\u002F2.verifying",{"title":45,"path":46,"stem":47},"Multi-signature","\u002Fjwt\u002Fjws\u002Fmulti-signature","1.JWT\u002F1.JWS\u002F3.multi-signature",{"title":49,"path":50,"stem":51},"Algorithms","\u002Fjwt\u002Fjws\u002Falgorithms","1.JWT\u002F1.JWS\u002F4.algorithms",{"title":53,"path":54,"stem":55,"children":56,"icon":58},"JWE","\u002Fjwt\u002Fjwe","1.JWT\u002F2.JWE\u002F0.index",[57,59,63,67,71,75],{"title":53,"path":54,"stem":55,"icon":58},"i-carbon-locked",{"title":60,"path":61,"stem":62},"Encrypting","\u002Fjwt\u002Fjwe\u002Fencrypting","1.JWT\u002F2.JWE\u002F1.encrypting",{"title":64,"path":65,"stem":66},"Decrypting","\u002Fjwt\u002Fjwe\u002Fdecrypting","1.JWT\u002F2.JWE\u002F2.decrypting",{"title":68,"path":69,"stem":70},"Multi-recipient","\u002Fjwt\u002Fjwe\u002Fmulti-recipient","1.JWT\u002F2.JWE\u002F3.multi-recipient",{"title":72,"path":73,"stem":74},"ECDH-ES and end-to-end encryption","\u002Fjwt\u002Fjwe\u002Fecdh-es","1.JWT\u002F2.JWE\u002F4.ecdh-es",{"title":49,"path":76,"stem":77},"\u002Fjwt\u002Fjwe\u002Falgorithms","1.JWT\u002F2.JWE\u002F5.algorithms",{"title":79,"path":80,"stem":81,"children":82,"icon":84},"Examples","\u002Fexamples","10.Examples\u002F0.index",[83,85,90,94,98,102],{"title":79,"path":80,"stem":81,"icon":84},"i-carbon-code-reference",{"title":86,"path":87,"stem":88,"icon":89},"Authentication basics","\u002Fexamples\u002Fauthentication-basics","10.Examples\u002F1.authentication-basics","i-lucide-code",{"title":91,"path":92,"stem":93,"icon":89},"Consuming a JWKS endpoint","\u002Fexamples\u002Fjwks-endpoint","10.Examples\u002F2.jwks-endpoint",{"title":95,"path":96,"stem":97,"icon":89},"Refresh token pattern","\u002Fexamples\u002Frefresh-token-pattern","10.Examples\u002F3.refresh-token-pattern",{"title":99,"path":100,"stem":101,"icon":89},"End-to-end encryption","\u002Fexamples\u002Fend-to-end-encryption","10.Examples\u002F4.end-to-end-encryption",{"title":103,"path":104,"stem":105,"icon":89},"Signed receipts","\u002Fexamples\u002Fsigned-receipts","10.Examples\u002F5.signed-receipts",{"title":107,"path":108,"stem":109,"children":110,"icon":112},"JWK","\u002Fjwk","2.JWK\u002F0.index",[111,113,117,121,125,129,133,137],{"title":107,"path":108,"stem":109,"icon":112},"i-carbon-two-factor-authentication",{"title":114,"path":115,"stem":116},"Generating keys","\u002Fjwk\u002Fgenerating","2.JWK\u002F1.generating",{"title":118,"path":119,"stem":120},"Importing and exporting","\u002Fjwk\u002Fimport-export","2.JWK\u002F2.import-export",{"title":122,"path":123,"stem":124},"PEM conversion","\u002Fjwk\u002Fpem","2.JWK\u002F3.pem",{"title":126,"path":127,"stem":128},"Key wrapping","\u002Fjwk\u002Fwrapping","2.JWK\u002F4.wrapping",{"title":130,"path":131,"stem":132},"Password derivation","\u002Fjwk\u002Fpassword-derivation","2.JWK\u002F5.password-derivation",{"title":134,"path":135,"stem":136},"JWK Sets","\u002Fjwk\u002Fjwk-sets","2.JWK\u002F6.jwk-sets",{"title":138,"path":139,"stem":140},"JWK cache","\u002Fjwk\u002Fcache","2.JWK\u002F7.cache",{"title":142,"path":143,"stem":144,"children":145,"icon":147},"Utilities","\u002Futilities","3.Utilities\u002F0.index",[146],{"title":142,"path":143,"stem":144,"icon":147},"i-carbon-tool-box",{"title":149,"path":150,"stem":151,"children":152,"icon":154},"Adapters","\u002Fadapters","99.Adapters\u002F0.index",[153,155,159,163],{"title":149,"path":150,"stem":151,"icon":154},"i-carbon-plug",{"title":156,"path":157,"stem":158},"H3 sessions","\u002Fadapters\u002Fh3-sessions","99.Adapters\u002F1.h3-sessions",{"title":160,"path":161,"stem":162},"Lifecycle hooks","\u002Fadapters\u002Fhooks","99.Adapters\u002F2.hooks",{"title":164,"path":165,"stem":166},"Lower-level functions","\u002Fadapters\u002Flower-level","99.Adapters\u002F3.lower-level",{"id":168,"title":114,"body":169,"description":226,"extension":1387,"meta":1388,"navigation":1389,"path":115,"seo":1390,"stem":116,"__hash__":1391},"content\u002F2.JWK\u002F1.generating.md",{"type":170,"value":171,"toc":1373},"minimark",[172,176,207,214,220,248,266,535,540,675,695,723,727,846,900,904,910,1019,1028,1033,1048,1072,1173,1179,1227,1311,1319,1340,1344,1369],[173,174,175],"p",{},"unjwt gives you two functions for creating keys:",[177,178,179,191],"ul",{},[180,181,182,190],"li",{},[183,184,186],"a",{"href":185},"#generatejwk",[187,188,189],"code",{},"generateJWK"," — returns a JWK (or a pair of JWKs). Best for 99% of cases.",[180,192,193,199,200,203,204,206],{},[183,194,196],{"href":195},"#generatekey",[187,197,198],{},"generateKey"," — returns a ",[187,201,202],{},"CryptoKey"," (or pair, or raw bytes). Use when you need a non-extractable ",[187,205,202],{}," or raw byte output.",[173,208,209,210,213],{},"Both are in ",[187,211,212],{},"unjwt\u002Fjwk",".",[215,216,218],"h2",{"id":217},"generatejwk",[187,219,189],{},[221,222,227],"pre",{"className":223,"code":224,"language":225,"meta":226,"style":226},"language-ts shiki shiki-themes github-light github-dark github-dark","generateJWK(alg, options?)\n","ts","",[187,228,229],{"__ignoreMap":226},[230,231,234,237,241,245],"span",{"class":232,"line":233},"line",1,[230,235,189],{"class":236},"shcOC",[230,238,240],{"class":239},"slsVL","(alg, options",[230,242,244],{"class":243},"so5gQ","?",[230,246,247],{"class":239},")\n",[173,249,250,251,254,255,258,259,261,262,265],{},"Always returns a JWK (or pair) with ",[187,252,253],{},"alg"," and ",[187,256,257],{},"kid"," set. The ",[187,260,257],{}," is a fresh ",[187,263,264],{},"crypto.randomUUID()"," unless you provide one.",[221,267,270],{"className":223,"code":268,"filename":269,"language":225,"meta":226,"style":226},"import { generateJWK } from \"unjwt\u002Fjwk\";\n\n\u002F\u002F Symmetric → single JWK\nconst hmac = await generateJWK(\"HS256\");\n\u002F\u002F { kty: \"oct\", k: \"...\", alg: \"HS256\", kid: \"4c3d-...\" }\n\n\u002F\u002F Asymmetric → keypair\nconst { privateKey, publicKey } = await generateJWK(\"RS256\");\n\n\u002F\u002F Custom kid\nconst ec = await generateJWK(\"ES256\", { kid: \"ec-signing-2025\" });\n\n\u002F\u002F Custom RSA modulus\nconst rsa = await generateJWK(\"RS256\", { modulusLength: 4096, use: \"sig\" });\n\n\u002F\u002F Custom EC curve\nconst ecdh = await generateJWK(\"ECDH-ES+A256KW\", { namedCurve: \"X25519\" });\n\n\u002F\u002F EdDSA explicit\nconst ed = await generateJWK(\"Ed25519\");\n","examples.ts",[187,271,272,290,297,304,332,338,343,349,383,388,394,422,427,433,465,470,476,503,508,514],{"__ignoreMap":226},[230,273,274,277,280,283,287],{"class":232,"line":233},[230,275,276],{"class":243},"import",[230,278,279],{"class":239}," { generateJWK } ",[230,281,282],{"class":243},"from",[230,284,286],{"class":285},"sfrk1"," \"unjwt\u002Fjwk\"",[230,288,289],{"class":239},";\n",[230,291,293],{"class":232,"line":292},2,[230,294,296],{"emptyLinePlaceholder":295},true,"\n",[230,298,300],{"class":232,"line":299},3,[230,301,303],{"class":302},"sCsY4","\u002F\u002F Symmetric → single JWK\n",[230,305,307,310,314,317,320,323,326,329],{"class":232,"line":306},4,[230,308,309],{"class":243},"const",[230,311,313],{"class":312},"suiK_"," hmac",[230,315,316],{"class":243}," =",[230,318,319],{"class":243}," await",[230,321,322],{"class":236}," generateJWK",[230,324,325],{"class":239},"(",[230,327,328],{"class":285},"\"HS256\"",[230,330,331],{"class":239},");\n",[230,333,335],{"class":232,"line":334},5,[230,336,337],{"class":302},"\u002F\u002F { kty: \"oct\", k: \"...\", alg: \"HS256\", kid: \"4c3d-...\" }\n",[230,339,341],{"class":232,"line":340},6,[230,342,296],{"emptyLinePlaceholder":295},[230,344,346],{"class":232,"line":345},7,[230,347,348],{"class":302},"\u002F\u002F Asymmetric → keypair\n",[230,350,352,354,357,360,363,366,369,372,374,376,378,381],{"class":232,"line":351},8,[230,353,309],{"class":243},[230,355,356],{"class":239}," { ",[230,358,359],{"class":312},"privateKey",[230,361,362],{"class":239},", ",[230,364,365],{"class":312},"publicKey",[230,367,368],{"class":239}," } ",[230,370,371],{"class":243},"=",[230,373,319],{"class":243},[230,375,322],{"class":236},[230,377,325],{"class":239},[230,379,380],{"class":285},"\"RS256\"",[230,382,331],{"class":239},[230,384,386],{"class":232,"line":385},9,[230,387,296],{"emptyLinePlaceholder":295},[230,389,391],{"class":232,"line":390},10,[230,392,393],{"class":302},"\u002F\u002F Custom kid\n",[230,395,397,399,402,404,406,408,410,413,416,419],{"class":232,"line":396},11,[230,398,309],{"class":243},[230,400,401],{"class":312}," ec",[230,403,316],{"class":243},[230,405,319],{"class":243},[230,407,322],{"class":236},[230,409,325],{"class":239},[230,411,412],{"class":285},"\"ES256\"",[230,414,415],{"class":239},", { kid: ",[230,417,418],{"class":285},"\"ec-signing-2025\"",[230,420,421],{"class":239}," });\n",[230,423,425],{"class":232,"line":424},12,[230,426,296],{"emptyLinePlaceholder":295},[230,428,430],{"class":232,"line":429},13,[230,431,432],{"class":302},"\u002F\u002F Custom RSA modulus\n",[230,434,436,438,441,443,445,447,449,451,454,457,460,463],{"class":232,"line":435},14,[230,437,309],{"class":243},[230,439,440],{"class":312}," rsa",[230,442,316],{"class":243},[230,444,319],{"class":243},[230,446,322],{"class":236},[230,448,325],{"class":239},[230,450,380],{"class":285},[230,452,453],{"class":239},", { modulusLength: ",[230,455,456],{"class":312},"4096",[230,458,459],{"class":239},", use: ",[230,461,462],{"class":285},"\"sig\"",[230,464,421],{"class":239},[230,466,468],{"class":232,"line":467},15,[230,469,296],{"emptyLinePlaceholder":295},[230,471,473],{"class":232,"line":472},16,[230,474,475],{"class":302},"\u002F\u002F Custom EC curve\n",[230,477,479,481,484,486,488,490,492,495,498,501],{"class":232,"line":478},17,[230,480,309],{"class":243},[230,482,483],{"class":312}," ecdh",[230,485,316],{"class":243},[230,487,319],{"class":243},[230,489,322],{"class":236},[230,491,325],{"class":239},[230,493,494],{"class":285},"\"ECDH-ES+A256KW\"",[230,496,497],{"class":239},", { namedCurve: ",[230,499,500],{"class":285},"\"X25519\"",[230,502,421],{"class":239},[230,504,506],{"class":232,"line":505},18,[230,507,296],{"emptyLinePlaceholder":295},[230,509,511],{"class":232,"line":510},19,[230,512,513],{"class":302},"\u002F\u002F EdDSA explicit\n",[230,515,517,519,522,524,526,528,530,533],{"class":232,"line":516},20,[230,518,309],{"class":243},[230,520,521],{"class":312}," ed",[230,523,316],{"class":243},[230,525,319],{"class":243},[230,527,322],{"class":236},[230,529,325],{"class":239},[230,531,532],{"class":285},"\"Ed25519\"",[230,534,331],{"class":239},[536,537,539],"h3",{"id":538},"options","Options",[541,542,543,559],"table",{},[544,545,546],"thead",{},[547,548,549,553,556],"tr",{},[550,551,552],"th",{},"Option",[550,554,555],{},"Applies to",[550,557,558],{},"Default",[560,561,562,576,588,602,616,631,646,661],"tbody",{},[547,563,564,569,572],{},[565,566,567],"td",{},[187,568,257],{},[565,570,571],{},"Any",[565,573,574],{},[187,575,264],{},[547,577,578,583,585],{},[565,579,580],{},[187,581,582],{},"use",[565,584,571],{},[565,586,587],{},"—",[547,589,590,595,597],{},[565,591,592],{},[187,593,594],{},"extractable",[565,596,571],{},[565,598,599],{},[187,600,601],{},"true",[547,603,604,609,611],{},[565,605,606],{},[187,607,608],{},"keyUsage",[565,610,571],{},[565,612,613,614],{},"Derived from ",[187,615,253],{},[547,617,618,623,626],{},[565,619,620],{},[187,621,622],{},"modulusLength",[565,624,625],{},"RSA only",[565,627,628],{},[187,629,630],{},"2048",[547,632,633,638,640],{},[565,634,635],{},[187,636,637],{},"publicExponent",[565,639,625],{},[565,641,642,645],{},[187,643,644],{},"0x010001"," (65537)",[547,647,648,653,656],{},[565,649,650],{},[187,651,652],{},"namedCurve",[565,654,655],{},"EC \u002F OKP",[565,657,613,658,660],{},[187,659,253],{}," (see below)",[547,662,663,666,668],{},[565,664,665],{},"Any JWK metadata",[565,667,571],{},[565,669,670,671,674],{},"Merged into the result (",[187,672,673],{},"x5c",", etc.)",[173,676,677,362,679,362,682,685,686,689,690,694],{},[187,678,253],{},[187,680,681],{},"kty",[187,683,684],{},"key_ops",", and ",[187,687,688],{},"ext"," are ",[691,692,693],"strong",{},"managed by the library"," and cannot be overridden via options — they must match the key material.",[696,697,698],"warning",{},[173,699,700,701,704,705,708,709,712,713,716,717,722],{},"PBES2 algorithms (",[187,702,703],{},"PBES2-*",") aren't generation-time algorithms — they're ",[691,706,707],{},"key-derivation"," algorithms. Passing ",[187,710,711],{},"\"PBES2-HS256+A128KW\""," to ",[187,714,715],{},"generateJWK()"," throws. Use ",[183,718,719],{"href":131},[187,720,721],{},"deriveJWKFromPassword"," instead.",[536,724,726],{"id":725},"algorithm-output-shape","Algorithm → output shape",[541,728,729,739],{},[544,730,731],{},[547,732,733,736],{},[550,734,735],{},"Algorithm",[550,737,738],{},"Returns",[560,740,741,762,780,798,810,825],{},[547,742,743,757],{},[565,744,745,362,748,362,751,362,754],{},[187,746,747],{},"HS*",[187,749,750],{},"A*KW",[187,752,753],{},"A*GCM",[187,755,756],{},"A*GCMKW",[565,758,759],{},[187,760,761],{},"JWK_oct\u003CAlg>",[547,763,764,775],{},[565,765,766,362,769,362,772],{},[187,767,768],{},"A128CBC-HS256",[187,770,771],{},"A192CBC-HS384",[187,773,774],{},"A256CBC-HS512",[565,776,777,779],{},[187,778,761],{}," (composite AES+HMAC bytes serialized as one key)",[547,781,782,793],{},[565,783,784,362,787,362,790],{},[187,785,786],{},"RS*",[187,788,789],{},"PS*",[187,791,792],{},"RSA-OAEP*",[565,794,795],{},[187,796,797],{},"{ privateKey: JWK_RSA_Private\u003CAlg>; publicKey: JWK_RSA_Public\u003CAlg> }",[547,799,800,805],{},[565,801,802],{},[187,803,804],{},"ES*",[565,806,807],{},[187,808,809],{},"{ privateKey: JWK_EC_Private\u003CAlg>; publicKey: JWK_EC_Public\u003CAlg> }",[547,811,812,820],{},[565,813,814,362,817],{},[187,815,816],{},"Ed25519",[187,818,819],{},"EdDSA",[565,821,822],{},[187,823,824],{},"{ privateKey: JWK_OKP_Private\u003CAlg>; publicKey: JWK_OKP_Public\u003CAlg> }",[547,826,827,832],{},[565,828,829],{},[187,830,831],{},"ECDH-ES*",[565,833,834,835,838,839,842,843],{},"EC pair (default curves) ",[691,836,837],{},"or"," OKP pair (for ",[187,840,841],{},"X25519",") — see ",[187,844,845],{},"JWK_Pair",[173,847,848,849,852,853,362,856,852,859,862,863,868,869,868,874,868,879,884,885,887,888,891,892,895,896,899],{},"The literal algorithm is preserved in the return type — ",[187,850,851],{},"generateJWK(\"HS256\")"," is ",[187,854,855],{},"JWK_oct\u003C\"HS256\">",[187,857,858],{},"generateJWK(\"RS256\")",[187,860,861],{},"{ publicKey: JWK_RSA_Public\u003C\"RS256\">; privateKey: JWK_RSA_Private\u003C\"RS256\"> }",". This narrowing flows through into ",[183,864,865],{"href":38},[187,866,867],{},"sign"," \u002F ",[183,870,871],{"href":42},[187,872,873],{},"verify",[183,875,876],{"href":61},[187,877,878],{},"encrypt",[183,880,881],{"href":65},[187,882,883],{},"decrypt",", which reject JWKs whose ",[187,886,253],{}," points at the wrong algorithm family at the type level. For generic variables, ",[187,889,890],{},"JWK_Pair\u003CAlg>"," picks the right pair shape per algorithm (e.g. ",[187,893,894],{},"JWK_Pair\u003C\"ECDH-ES+A256KW\">"," is an EC pair ",[897,898,837],"em",{}," an OKP pair — whichever the runtime curve produces).",[536,901,903],{"id":902},"curve-defaults","Curve defaults",[173,905,906,907,909],{},"For EC\u002FOKP algorithms, the ",[187,908,652],{}," defaults follow the JOSE registry:",[541,911,912,924],{},[544,913,914],{},[547,915,916,918,921],{},[550,917,735],{},[550,919,920],{},"Default curve",[550,922,923],{},"Allowed curves",[560,925,926,943,959,975,999],{},[547,927,928,933,938],{},[565,929,930],{},[187,931,932],{},"ES256",[565,934,935],{},[187,936,937],{},"P-256",[565,939,940,942],{},[187,941,937],{}," only",[547,944,945,950,955],{},[565,946,947],{},[187,948,949],{},"ES384",[565,951,952],{},[187,953,954],{},"P-384",[565,956,957,942],{},[187,958,954],{},[547,960,961,966,971],{},[565,962,963],{},[187,964,965],{},"ES512",[565,967,968],{},[187,969,970],{},"P-521",[565,972,973,942],{},[187,974,970],{},[547,976,977,984,988],{},[565,978,979,981,982],{},[187,980,816],{},"\u002F",[187,983,819],{},[565,985,986],{},[187,987,816],{},[565,989,990,362,992,995,996],{},[187,991,816],{},[187,993,994],{},"Ed448"," ",[897,997,998],{},"(experimental)",[547,1000,1001,1005,1009],{},[565,1002,1003],{},[187,1004,831],{},[565,1006,1007],{},[187,1008,937],{},[565,1010,1011,362,1013,362,1015,362,1017],{},[187,1012,937],{},[187,1014,954],{},[187,1016,970],{},[187,1018,841],{},[1020,1021,1022],"tip",{},[173,1023,1024,1025,1027],{},"For new ECDH-ES key pairs, ",[187,1026,841],{}," is the modern choice — constant-time, compact, and not subject to the NIST-curve \"is this a valid point?\" validation overhead.",[215,1029,1031],{"id":1030},"generatekey",[187,1032,198],{},[221,1034,1036],{"className":223,"code":1035,"language":225,"meta":226,"style":226},"generateKey(alg, options?)\n",[187,1037,1038],{"__ignoreMap":226},[230,1039,1040,1042,1044,1046],{"class":232,"line":233},[230,1041,198],{"class":236},[230,1043,240],{"class":239},[230,1045,244],{"class":243},[230,1047,247],{"class":239},[173,1049,1050,1051,362,1053,1056,1057,1060,1061,1064,1065,1067,1068,1071],{},"Returns a ",[187,1052,202],{},[187,1054,1055],{},"CryptoKeyPair",", or ",[187,1058,1059],{},"Uint8Array"," depending on the algorithm — ",[691,1062,1063],{},"without"," wrapping it as a JWK. The exact return type is narrowed by ",[187,1066,253],{}," and by ",[187,1069,1070],{},"options.toJWK",":",[541,1073,1074,1092],{},[544,1075,1076],{},[547,1077,1078,1081,1087],{},[550,1079,1080],{},"Algorithm family",[550,1082,1083,1086],{},[187,1084,1085],{},"toJWK: false"," (default)",[550,1088,1089],{},[187,1090,1091],{},"toJWK: true",[560,1093,1094,1115,1135,1154],{},[547,1095,1096,1106,1110],{},[565,1097,1098,362,1100,362,1102,362,1104],{},[187,1099,747],{},[187,1101,750],{},[187,1103,753],{},[187,1105,756],{},[565,1107,1108],{},[187,1109,202],{},[565,1111,1112],{},[187,1113,1114],{},"JWK_oct",[547,1116,1117,1125,1131],{},[565,1118,1119,362,1121,362,1123],{},[187,1120,768],{},[187,1122,771],{},[187,1124,774],{},[565,1126,1127,1130],{},[187,1128,1129],{},"Uint8Array\u003CArrayBuffer>"," (composite AES+HMAC bytes)",[565,1132,1133],{},[187,1134,1114],{},[547,1136,1137,1145,1149],{},[565,1138,1139,362,1141,362,1143],{},[187,1140,786],{},[187,1142,789],{},[187,1144,792],{},[565,1146,1147],{},[187,1148,1055],{},[565,1150,1151],{},[187,1152,1153],{},"{ privateKey: JWK, publicKey: JWK }",[547,1155,1156,1166,1170],{},[565,1157,1158,362,1160,362,1162,362,1164],{},[187,1159,804],{},[187,1161,816],{},[187,1163,819],{},[187,1165,831],{},[565,1167,1168],{},[187,1169,1055],{},[565,1171,1172],{},"Same pair shape",[536,1174,1176,1177],{"id":1175},"when-to-use-generatekey","When to use ",[187,1178,198],{},[177,1180,1181,1191,1211],{},[180,1182,1183,1186,1187,1190],{},[691,1184,1185],{},"Non-extractable keys"," — call ",[187,1188,1189],{},"generateKey(\"HS256\", { extractable: false })"," to keep the key material inside Web Crypto only. Handy for server-side session-signing keys that shouldn't be exported.",[180,1192,1193,1200,1201,1204,1205,1207,1208,213],{},[691,1194,1195,1196,1199],{},"Raw bytes for ",[187,1197,1198],{},"dir"," \u002F AES-CBC-HS*"," — ",[187,1202,1203],{},"generateKey(\"A256GCM\")"," returns a ",[187,1206,202],{}," directly usable as a CEK for ",[187,1209,1210],{},"alg: \"dir\"",[180,1212,1213,1200,1216,1219,1220,1223,1224,1226],{},[691,1214,1215],{},"Composite AES+HMAC bytes",[187,1217,1218],{},"generateKey(\"A256CBC-HS512\")"," gives you the 64-byte composite buffer ready for use with ",[187,1221,1222],{},"encrypt()"," (",[187,1225,1210],{},").",[221,1228,1231],{"className":223,"code":1229,"filename":1230,"language":225,"meta":226,"style":226},"import { generateKey } from \"unjwt\u002Fjwk\";\n\n\u002F\u002F A CryptoKey that can never be exported as JWK\nconst sessionKey = await generateKey(\"HS256\", { extractable: false });\n\n\u002F\u002F sign() can still use it\nawait sign({ sub: \"u1\" }, sessionKey, { alg: \"HS256\" });\n","non-extractable.ts",[187,1232,1233,1246,1250,1255,1281,1285,1290],{"__ignoreMap":226},[230,1234,1235,1237,1240,1242,1244],{"class":232,"line":233},[230,1236,276],{"class":243},[230,1238,1239],{"class":239}," { generateKey } ",[230,1241,282],{"class":243},[230,1243,286],{"class":285},[230,1245,289],{"class":239},[230,1247,1248],{"class":232,"line":292},[230,1249,296],{"emptyLinePlaceholder":295},[230,1251,1252],{"class":232,"line":299},[230,1253,1254],{"class":302},"\u002F\u002F A CryptoKey that can never be exported as JWK\n",[230,1256,1257,1259,1262,1264,1266,1269,1271,1273,1276,1279],{"class":232,"line":306},[230,1258,309],{"class":243},[230,1260,1261],{"class":312}," sessionKey",[230,1263,316],{"class":243},[230,1265,319],{"class":243},[230,1267,1268],{"class":236}," generateKey",[230,1270,325],{"class":239},[230,1272,328],{"class":285},[230,1274,1275],{"class":239},", { extractable: ",[230,1277,1278],{"class":312},"false",[230,1280,421],{"class":239},[230,1282,1283],{"class":232,"line":334},[230,1284,296],{"emptyLinePlaceholder":295},[230,1286,1287],{"class":232,"line":340},[230,1288,1289],{"class":302},"\u002F\u002F sign() can still use it\n",[230,1291,1292,1295,1298,1301,1304,1307,1309],{"class":232,"line":345},[230,1293,1294],{"class":243},"await",[230,1296,1297],{"class":236}," sign",[230,1299,1300],{"class":239},"({ sub: ",[230,1302,1303],{"class":285},"\"u1\"",[230,1305,1306],{"class":239}," }, sessionKey, { alg: ",[230,1308,328],{"class":285},[230,1310,421],{"class":239},[536,1312,1314,1316,1317],{"id":1313},"tojwk-true-vs-generatejwk",[187,1315,1091],{}," vs ",[187,1318,189],{},[173,1320,1321,254,1324,1326,1327,1329,1330,1332,1333,1335,1336,1339],{},[187,1322,1323],{},"generateKey(\"HS256\", { toJWK: true })",[187,1325,851],{}," both return a ",[187,1328,1114],{},", but ",[187,1331,189],{}," is the ergonomic path for JWK output: it always sets ",[187,1334,257],{}," and accepts JWK metadata fields in its options. Use ",[187,1337,1338],{},"generateKey({ toJWK: true })"," only when you need a specific non-extractable setup that happens to serialize as JWK — rare.",[215,1341,1343],{"id":1342},"see-also","See also",[177,1345,1346,1351,1357,1363],{},[180,1347,1348],{},[183,1349,1350],{"href":119},"Importing & exporting →",[180,1352,1353,1356],{},[183,1354,1355],{"href":50},"JWS algorithms →"," — which signing alg to pick.",[180,1358,1359,1362],{},[183,1360,1361],{"href":76},"JWE algorithms →"," — which encryption alg to pick.",[180,1364,1365,1368],{},[183,1366,1367],{"href":131},"Password derivation →"," — for PBES2.",[1370,1371,1372],"style",{},"html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}",{"title":226,"searchDepth":292,"depth":292,"links":1374},[1375,1380,1386],{"id":217,"depth":292,"text":189,"children":1376},[1377,1378,1379],{"id":538,"depth":299,"text":539},{"id":725,"depth":299,"text":726},{"id":902,"depth":299,"text":903},{"id":1030,"depth":292,"text":198,"children":1381},[1382,1384],{"id":1175,"depth":299,"text":1383},"When to use generateKey",{"id":1313,"depth":299,"text":1385},"toJWK: true vs generateJWK",{"id":1342,"depth":292,"text":1343},"md",{},{},{"title":114,"description":226},"3pRs1Mudw4DBS9XllNx8tPesDGlB5jQ1s9qPvoSjelg",[1393,1394],{"title":107,"path":108,"stem":109,"description":226,"icon":112,"children":-1},{"title":118,"path":119,"stem":120,"description":226,"children":-1},1776888559429]