Tool

JWKS Viewer

Inspect JWKS documents, export public PEM, and build a public JWKS from SPKI keys — entirely in your browser.

Last updated August 26, 2026

JWKS or JWK JSON

Runs entirely in your browser. Paste JWKS JSON only — this tool does not fetch remote JWKS URLs. Sample keys are ephemeral demos, not production signing material. Never publish private keys in a JWKS document.

Runs entirely in your browser — no data sent to servers. Privacy policy

How to Use This Tool

Paste a JWKS document ({ "keys": [...] }) or a single JWK into View mode — or click Load sample — then Inspect keys. Review kid, kty, alg, use, and size or curve for each entry.

If a key includes private fields (d, p, q, …), treat it as secret material. Use Copy public-only before publishing; never ship private JWKs on a public JWKS endpoint.

For RSA or EC public keys, click Export public PEM to convert the JWK to SPKI PEM for libraries that prefer PEM files.

Switch to Build mode, paste an SPKI public PEM (from the RSA Key Generator or your issuer), set kid/alg/use, and add keys to assemble a JWKS JSON document you can copy. Mismatched alg (e.g. RS256 on an EC key) is corrected automatically.

This tool does not fetch remote JWKS URLs. Paste JSON only so key material stays in your browser. Sample keys are ephemeral demos, not production signing material.

Code Examples

const { createRemoteJWKSet, jwtVerify } = require('jose');

// Production: configured issuer JWKS URI (never trust token jku)
const JWKS = createRemoteJWKSet(new URL(process.env.OIDC_JWKS_URI));

async function verifyAccessToken(token) {
  const { payload } = await jwtVerify(token, JWKS, {
    algorithms: ['RS256'],
    issuer: process.env.OIDC_ISSUER,
    audience: process.env.API_AUDIENCE,
  });
  return payload;
}

// Lab: inspect/build JWKS in the browser JWKS Viewer, save as jwks.json for local tests.

Frequently Asked Questions

What is a JWKS document?

A JSON Web Key Set is a JSON object with a keys array of public JWKs. Issuers publish JWKS so verifiers can select the correct public key by kid when validating RS256 or ES256 JWTs without sharing private signing material.

Does this tool fetch my JWKS URL?

No. Paste the JWKS JSON yourself (or load a local sample). Keeping fetches out of the browser tool avoids proxying your network through our site and keeps the client-side trust model honest.

Can I put private keys in JWKS?

Never on a public endpoint. JWKS must contain public keys only. If the viewer flags private fields (d, p, q, …), strip them with Copy public-only before publishing and rotate any exposed signing keys.

How do I build a JWKS from an RSA PEM?

Generate or obtain an SPKI public PEM, open Build mode, set kid and alg (often RS256), add the key, then copy the resulting JWKS JSON for your /.well-known/jwks.json or secrets store.

Which algorithms are supported for PEM export?

RSA and EC (P-256, P-384, P-521) public keys via Web Crypto. Octet (HMAC) secrets and OKP/Ed25519 appear in View mode when present but are not converted to PEM in this tool.

Is the Load sample key safe for production?

No. Sample keys are generated ephemerally in your browser for UI demos. Generate real issuer keys with your HSM or RSA Key Generator and keep private material out of JWKS.