By · Updated

JWKS Inspector

Key ID, Algorithm and RFC 7638 Thumbprint for Each Key, Plus Leak Warnings

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the JWKS Inspector works

This JWKS inspector reads a JSON Web Key Set and lays out every key in a table: key id, type, algorithm, use, size and thumbprint. It also checks the set for the mistakes that break token validation or leak secrets, such as private key members published in a public endpoint.

What the JWKS inspector flags

A JWKS is the public list of keys an identity provider uses to sign tokens. Clients pick a key by its kid, so a missing or duplicated kid means a verifier may pick the wrong key or none at all. Each key should name its alg and either use or key_ops so it cannot be misused for another purpose.

The biggest risk is a private key in a public set. RSA private members (d, p, q, dp, dq, qi), the EC or OKP d and an oct key's k should never appear, and the inspector warns about each one. RSA keys under 2048 bits are flagged as too weak. The thumbprint column is the RFC 7638 SHA-256 thumbprint, which some systems use as a stable key id.

FAQ

Where do I find a provider's JWKS?

Look for jwks_uri in the provider's OpenID configuration at /.well-known/openid-configuration, or try /.well-known/jwks.json on the issuer's domain. Open the URL in a new tab, copy the JSON and paste it here. The inspector does not fetch URLs itself.

Why would a JWKS contain more than one key?

Providers publish the current signing key and the next or previous one so they can rotate keys without breaking tokens already issued. Each has its own kid, and tokens name the kid they were signed with. Old keys are removed once all tokens signed with them have expired.

What should I do if the set contains private keys?

Treat those keys as compromised. Remove them from the published set, generate new key pairs, publish only the public halves and revoke or let expire any tokens signed with the leaked keys. Then find out how the private members reached the endpoint.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

JWT Signature Verifier

Verify a JWT's signature with a secret, PEM key or JWKS.

PEM To JWK Converter

Convert public and private keys between PEM and JWK.

JWT Decoder

Decode a JWT and read its claims and expiry.

PEM Inspector

Decode PEM and DER into a readable ASN.1 tree.

JWT Encoder

Sign a JSON payload into an HS256, HS384 or HS512 JWT.