jose-jwk-pub - Man Page

Cleans private keys from a JWK


jose jwk pub -i JWK [-o JWK]


The jose jwk pub command removes all private key material from one or more JWK(Set) inputs. The output will contain only public key material.

If the JWK contains the "key_ops" property, it will be automatically adjusted to include only operations relevant to public keys.


-i JSON, --input=JSON

Parse JWK(Set) from JSON

-i FILE, --input=FILE

Read JWK(Set) from FILE

-i -, --input=-

Read JWK(Set) from standard input

-o FILE, --output=FILE

Write JWK(Set) to FILE

-o -, --output=-

Write JWK(Set) to standard input

-s,  --set

Always output a JWKSet


Clean private key material from a JWK:

$ jose jwk gen -i ´{"alg":"ES256"}´ -o prv.jwk
$ cat prv.jwk
{"alg":"ES256","crv":"P-256","key_ops":["sign","verify"],"kty":"EC", ...}
$ jose jwk pub -i prv.jwk -o pub.jwk
$ cat pub.jwk
{"alg":"ES256","crv":"P-256","key_ops":["verify"],"kty":"EC", ...}


Nathaniel McCallum <>

See Also

jose-alg(1), jose-jwe-enc(1), jose-jwk-exc(1), jose-jwk-gen(1), jose-jwk-thp(1), jose-jwk-use(1), jose-jws-ver(1)

Referenced By

jose(1), jose-jwk-exc(1), jose-jwk-gen(1).

June 2017