JWKS Inspector

Paste a full JWKS ({"keys":[...]}) to see every key at a glance — algorithm, size or curve, kid, and use — without picking one to convert. Useful for auditing a key set before wiring it into verification code.

JWKS JSON — drag a file in, or

How to use it

Paste a JWKS document, drop a local JSON file, or load the example.
Select Inspect or press Ctrl/⌘ + Enter.
Review every key’s kid, key type, size or curve, intended use, algorithm, and import status.
Use the JWKS to PEM Converter when one public key must be exported for another tool.

JWKS inspection example

{
  "keys": [{
    "kty": "RSA",
    "kid": "signing-2026-07",
    "use": "sig",
    "alg": "RS256",
    "n": "...",
    "e": "AQAB"
  }]
}

The inspector identifies this as an RSA signing key and calculates its modulus size from n. It also imports the JWK with the browser’s Web Crypto API. A row marked valid therefore passed more than a JSON shape check, although it does not prove that the key belongs to a trusted issuer.

How to read a JWK row

kid is the identifier a JWT header normally uses to select a key during rotation.
kty describes the key family, such as RSA or EC.
use commonly contains sig for signing or enc for encryption.
alg states the algorithm the publisher associates with the key, such as RS256.
The detail column reports RSA modulus bits or the named elliptic curve.

These fields should agree with the tokens and verification policy used by the application. For example, a token declaring RS256 should not be verified with an EC key, and an encryption key should not be selected as a signing key.

Key rotation and kid mismatches

Identity providers often publish an old and a new signing key during rotation. If a token’s kid is not present, the verifier may be using a stale JWKS, the issuer may have rotated too quickly, or the token may come from a different environment. Compare the issuer, refresh the key set through your application’s trusted network path, and never select an unrelated key merely because it is first in the array.

Limits and safe handling

The inspector supports RSA and EC JWK imports. Unsupported key types, malformed Base64url values, and invalid curves are reported per row so one bad entry does not hide the rest of the set. A successful import does not validate certificates, issuer ownership, token claims, or key trust. Use JWT Decoder to test a token with the correct public key.

JWKS endpoints normally contain public keys, but pasted sets can still reveal internal issuer names and rotation details. Cryonel reads files locally and performs every import in the current browser tab; it does not fetch the endpoint or send the set to a server.

Frequently Asked Questions

How is this different from JWKS to PEM?

JWKS to PEM converts one selected key to PEM format. This tool instead summarizes every key in the set at once — algorithm, size/curve, kid, use — without converting any of them. Good for a quick audit or spotting a key rotation issue.

Why does one key show an error?

Each entry is actually imported via crypto.subtle.importKey, not just read as JSON — so a corrupted modulus, wrong curve name, or unsupported key type is reported as an error on that row instead of silently showing wrong data.

Does the inspector fetch or upload keys?

No. Paste or locally open the JWKS JSON. Cryonel does not fetch an issuer URL or upload the key set; parsing and Web Crypto imports happen in the browser.