What is a JWKS document?

A JSON Web Key Set is a JSON object with a keys array of public JWKs. Issuers publish JWKS so verifiers can select the correct public key by kid when validating RS256 or ES256 JWTs without sharing private signing material.

Does this tool fetch my JWKS URL?

No. Paste the JWKS JSON yourself (or load a local sample). Keeping fetches out of the browser tool avoids proxying your network through our site and keeps the client-side trust model honest.

Can I put private keys in JWKS?

Never on a public endpoint. JWKS must contain public keys only. If the viewer flags private fields (d, p, q, …), strip them with Copy public-only before publishing and rotate any exposed signing keys.

How do I build a JWKS from an RSA PEM?

Generate or obtain an SPKI public PEM, open Build mode, set kid and alg (often RS256), add the key, then copy the resulting JWKS JSON for your /.well-known/jwks.json or secrets store.

Which algorithms are supported for PEM export?

RSA and EC (P-256, P-384, P-521) public keys via Web Crypto. Octet (HMAC) secrets and OKP/Ed25519 appear in View mode when present but are not converted to PEM in this tool.

Is the Load sample key safe for production?

No. Sample keys are generated ephemerally in your browser for UI demos. Generate real issuer keys with your HSM or RSA Key Generator and keep private material out of JWKS.

Tool

JWKS Viewer

Inspect JWKS documents, export public PEM, and build a public JWKS from SPKI keys — entirely in your browser.

Last updated August 26, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

JWKS or JWK JSON

Paste a JWKS document or load a sample, then click "Inspect keys".

Runs entirely in your browser. Paste JWKS JSON only — this tool does not fetch remote JWKS URLs. Sample keys are ephemeral demos, not production signing material. Never publish private keys in a JWKS document.

CLI equivalents (fetch JWKS)

curl -sS https://example.com/.well-known/jwks.json | jq '.keys[] | {kid,kty,alg,use}'

Paste a JWKS document ({ "keys": [...] }) or a single JWK into View mode — or click Load sample — then Inspect keys. Review kid, kty, alg, use, and size or curve for each entry.

If a key includes private fields (d, p, q, …), treat it as secret material. Use Copy public-only before publishing; never ship private JWKs on a public JWKS endpoint.

For RSA or EC public keys, click Export public PEM to convert the JWK to SPKI PEM for libraries that prefer PEM files.

Switch to Build mode, paste an SPKI public PEM (from the RSA Key Generator or your issuer), set kid/alg/use, and add keys to assemble a JWKS JSON document you can copy. Mismatched alg (e.g. RS256 on an EC key) is corrected automatically.

This tool does not fetch remote JWKS URLs. Paste JSON only so key material stays in your browser. Sample keys are ephemeral demos, not production signing material.

const { createRemoteJWKSet, jwtVerify } = require('jose');

// Production: configured issuer JWKS URI (never trust token jku)
const JWKS = createRemoteJWKSet(new URL(process.env.OIDC_JWKS_URI));

async function verifyAccessToken(token) {
  const { payload } = await jwtVerify(token, JWKS, {
    algorithms: ['RS256'],
    issuer: process.env.OIDC_ISSUER,
    audience: process.env.API_AUDIENCE,
  });
  return payload;
}

// Lab: inspect/build JWKS in the browser JWKS Viewer, save as jwks.json for local tests.

const { createRemoteJWKSet, jwtVerify } = require('jose');

// Production: configured issuer JWKS URI (never trust token jku)
const JWKS = createRemoteJWKSet(new URL(process.env.OIDC_JWKS_URI));

async function verifyAccessToken(token) {
  const { payload } = await jwtVerify(token, JWKS, {
    algorithms: ['RS256'],
    issuer: process.env.OIDC_ISSUER,
    audience: process.env.API_AUDIENCE,
  });
  return payload;
}

// Lab: inspect/build JWKS in the browser JWKS Viewer, save as jwks.json for local tests.

import os
import jwt
from jwt import PyJWKClient

client = PyJWKClient(os.environ["OIDC_JWKS_URI"])

def verify_access_token(token: str) -> dict:
    key = client.get_signing_key_from_jwt(token)
    return jwt.decode(
        token,
        key.key,
        algorithms=["RS256"],
        audience=os.environ["API_AUDIENCE"],
        issuer=os.environ["OIDC_ISSUER"],
    )

# Lab: paste issuer JWKS into the browser JWKS Viewer to confirm kids before deploy.

import (
    "os"

    "github.com/MicahParks/keyfunc/v2"
    "github.com/golang-jwt/jwt/v5"
)

jwks, err := keyfunc.Get(os.Getenv("OIDC_JWKS_URI"), keyfunc.Options{})
if err != nil {
    panic(err)
}
token, err := jwt.Parse(accessToken, jwks.Keyfunc, jwt.WithValidMethods([]string{"RS256"}))
if err != nil {
    panic(err)
}
_ = token.Valid
// Offline: inspect JWKS JSON with the browser JWKS Viewer during rotation incidents.

Continue learning

ToolsRSA Key GeneratorJWT ValidatorJWT Decoder

GuidesNode.jsPythonGoJavaRuby

ArticlesJWKS in ProductionDebug JWT Invalid SignatureHow to Rotate JWT SecretsHow to Validate a JWT Token

GlossaryJWKS EndpointJWKS URIJWK (JSON Web Key)kid (Key ID) ClaimSPKI Public Key FormatKey Rotation with kid

CompareHS256 vs RS256RS256 vs ES256Symmetric vs Asymmetric JWT Signing

AlgorithmsRS256 (RSA-SHA256)ES256 (ECDSA P-256)

ResourcesProduction JWT path

How to Use This Tool

Continue learning