JWKS Inspector

Review keys[] structure, kty/alg/use/crv fields, and accidental private material in a pasted JSON Web Key Set.

Inspect a JSON Web Key Set

Review the local keys[] inventory, filter by kid, find duplicate key IDs, and catch accidental private-key members before sharing a JWKS.

{"keys":[{"kty":"RSA","kid":"primary","use":"sig","alg":"RS256","n":"demo","e":"AQAB"},{"kty":"EC","kid":"backup","use":"sig","alg":"ES256","crv":"P-256","x":"demo","y":"demo"}]}

Filter by kid (optional)

Summary

—Keys

—Matched kid

—Duplicate kids

—Keys with private members

#	kid	kty	alg	use	crv	Private members

Structural inspection does not fetch an issuer, validate certificates, choose a trusted key, or prove that a JWKS belongs to any identity provider.

Trust and standards boundaries

Formatting is not schema validation, Base64 is not encryption, URL normalization is not a privacy guarantee, UUID metadata is not provenance, and decoded JWT claims are not trusted until cryptographic and application-specific validation succeeds. RS256 tools accept explicit PEM key formats and do not fetch issuer keys or make authorization decisions.