JWK Viewer & Generator

Inspect JSON Web Keys (JWK) and key sets (JWKS): view algorithm, use, and curve details, compute RFC 7638 thumbprints, or generate brand-new RSA, EC, or symmetric keys — entirely in your browser via the Web Crypto API.

Input JWK / JWKS
Drop JSON file here
Key Details

Features

🗝ī¸ Inspect Any Key

  • Single JWK or a full JWKS key set
  • RSA, EC, and symmetric (oct) keys
  • Flags private key material automatically
  • RFC 7638 SHA-256 thumbprint for every key

🎲 Generate New Keys

  • RSA-2048 key pairs for RS256
  • EC P-256 key pairs for ES256
  • Symmetric HS256 keys for HMAC signing
  • Uses the browser's native Web Crypto API

⚡ Privacy-First

  • Keys are generated and analyzed locally
  • Nothing is ever uploaded to a server
  • Pairs well with our JWT Decoder
  • Useful for debugging OAuth/OIDC jwks_uri endpoints

JWK & JWKS Guide

A JSON Web Key (JWK, RFC 7517) is a JSON representation of a cryptographic key used to sign or verify JWTs and JWEs. A JWKS (JSON Web Key Set) bundles multiple JWKs under a "keys" array — this is exactly what identity providers expose at their jwks_uri endpoint for verifying tokens. This tool decodes either shape, surfaces the fields you need for debugging, and computes each key's canonical thumbprint per RFC 7638 so you can confirm which key a token was signed with (matching its kid).

Frequently Asked Questions

What is a JWK thumbprint used for?

RFC 7638 defines a canonical way to hash a key's required members into a short, unique identifier. It's commonly used as a stable kid value or to confirm two JWK representations refer to the same underlying key.

Is it safe to paste a private key here?

All parsing and key generation happens locally in your browser using the Web Crypto API — nothing is sent to a server. That said, treat any real private key material as sensitive and avoid pasting production secrets into any web tool, including this one.

Which key types are supported?

Viewing supports RSA, EC, OKP, and oct (symmetric) keys. Generation currently produces RSA-2048 (RS256), EC P-256 (ES256), and symmetric HS256 keys — the most common algorithms used by JWT libraries.

Working safely with JSON Web Keys

JWKs are used wherever JWTs are signed or encrypted: identity providers publish their public keys as a JWKS so apps can verify tokens. Handling them correctly is mostly about keeping private material private and rotating keys smoothly.

Tips and common pitfalls

  • A public JWKS should contain only public parameters. For RSA that is n and e; a key with d, p or q is private and must never be published.
  • Give every key a unique kid so verifiers can pick the right key from the set.
  • Rotate by publishing the new key alongside the old one, switching signing to the new key, then removing the old key after tokens signed with it expire.
  • Set use (sig or enc) and alg to stop a key being used for the wrong purpose.

More questions

Where do I find a provider's JWKS?

Most OpenID Connect providers link it from their discovery document at /.well-known/openid-configuration under jwks_uri.

RSA or EC keys?

Both are widely supported. EC keys such as P-256 (ES256) give smaller keys and signatures for similar security, while RSA (RS256) has the broadest compatibility.