JWK / JWKS Inspector
Inspect key structure first, then match the token header to the right key
Inspect keys and selection hints
JWT or header input is optional now. Leave it blank for structure-only JWK/JWKS inspection.
This page reads only the protected header when a token is pasted. Leave this blank if you only need JWK/JWKS field inspection.
Paste the published JWKS payload, or a single JWK object when you already isolated one key. Use test data when possible; private-key members are flagged in the results.
What This Inspector Checks
The inspector tells you whether the pasted JSON is a single JWK or a full JWKS, surfaces the fields that matter most, flags private material, and compares kid, algorithm, and key-type hints when you also paste a token header.
How to Use the Inspector
- Paste a JWK or JWKS document.
- Optionally paste a full JWT, JWE, or header JSON if you want key-selection hints.
- Review the summary, warnings, and visible key fields.
- Use exact matches first, then candidate keys and the full field list.
Fields That Matter Most
kidhelps a verifier choose one key from a published set.algis useful context, but it is not enough on its own if the key type still does not fit.useandkey_opshint at intent, but real verifier rules still matter.- Use
x5cto inspect the certificate chain andx5tto inspect the declared certificate thumbprint. Use curve or modulus fields to inspect the public-key structure. - Private members like
dorkshould be treated as sensitive material.
Related Tools
- JWT Decode Inspect token structure before comparing keys.
- OIDC Discovery Inspector Inspect the pasted metadata that identifies the issuer and
jwks_uri. - JWKS to PEM Convert the selected RSA or EC public key into PEM after isolating the intended JWK.
- JWK Thumbprint Calculator Derive a stable RFC 7638 thumbprint from the selected public key.
- JWT Verify Verify the signature after isolating the likely key.
FAQ
Does this page verify a JWT signature?
No. It helps with key inspection and key selection before you move to verification.
Can I use it with only a single JWK?
Yes. You can leave the token/header input empty and inspect the JWK structure on its own.
Does it fetch a remote JWKS URL?
No. Paste the JSON directly; this inspector does not fetch a remote JWKS URL.