Paste a JWK or JWKS and inspect key metadata, algorithms, thumbprints, and validation warnings locally in your browser.
Single JWK and JWKS inputs are supported. Remote JWKS URLs are never fetched.
Inspection is local only. This tool analyzes pasted JSON in your browser and does not fetch remote JWKS URLs, resolve `jku` or `x5u`, or verify live JWTs.
Paste a JWK or JWKS
The inspector will summarize fields, flag missing values, and compute thumbprints where supported.
JWK guide
Review the fields, key set structure, thumbprints, and warnings that matter when working with OAuth, OpenID Connect, and JWT verification keys.
A JWK, or JSON Web Key, is a JSON object that describes one cryptographic key. It usually includes the key type, an identifier, intended usage, algorithm hints, and the public parameters needed to reference that key safely.
A JWKS, or JSON Web Key Set, is a JSON document with a keys array. It groups several JWKs so an issuer can publish multiple signing or encryption keys together during rotation.
A JWK describes one key. A JWKS describes a set of keys. Verifiers often fetch a JWKS, then choose one JWK from the set by matching the token header kid and alg values.
Common fields include kty for key type, kid for key ID, use for intended usage, key_ops for permitted operations, and alg for algorithm hints. RSA keys use n and e; EC keys use crv, x, and y; symmetric keys use k.
JWT verifiers read the token header, look for the kid, and select the matching public key from the JWKS. They then check whether the declared algorithm matches the selected key and whether the signature verifies locally or in the service that owns the private key.
RFC 7638 thumbprints provide a stable identifier for a JWK by hashing a canonical JSON subset of the public key members. This inspector generates thumbprints for supported RSA and EC public keys when the required fields are present.
Private RSA and EC key material should stay out of browser tools unless you are working with safe test data. Symmetric oct keys are secrets and deserve the same caution. This inspector never fetches remote JWKS URLs or validates live JWTs.
No. It only inspects pasted JSON in your browser and does not resolve jku, x5u, or any remote key URL.
A JWK is one key. A JWKS is a JSON object that contains a keys array of one or more JWKs.
kid is the key identifier. Verifiers use it to choose the right key from a JWKS when several keys are published.
kty identifies the key family, such as RSA, EC, or oct. The required fields depend on that family.
Yes. The inspector understands RSA, EC, and symmetric oct keys where practical, and it highlights missing public parameters and key type mismatches.
Avoid using private keys or production secrets here. The page is browser-only, but private and symmetric key material should still be treated as sensitive.