JWKS Viewer

A JWKS (JSON Web Key Set) is how a server publishes the public keys it uses to sign tokens — usually served from a well-known URL like /.well-known/jwks.json — so that anyone verifying a token can look up the right key by its kid (key ID) without needing to be handed a PEM file out of band. It's the standard way OAuth providers, identity platforms, and API gateways distribute the public half of their signing keys.

Each entry in a JWKS is a JWK (JSON Web Key): a JSON object describing one key's type (RSA, EC, or a raw symmetric secret) and its material as base64url-encoded fields, rather than the PEM format most crypto tooling expects. This tool reads a JWKS (or a single JWK) and, for RSA and EC keys, converts it into standard PEM — the exact format the JWT Verifier tool on this site expects — entirely in your browser, using the Web Crypto API.

• •Match a token's kid (in its header) to the key with the same kid in the JWKS before verifying — a JWKS often contains multiple keys (for key rotation), and using the wrong one will make a perfectly valid token look invalid.
• •Symmetric (oct) keys can't be converted to PEM here on purpose — a symmetric key is a shared secret, not a public/private key pair, so there's no "public half" to export.
• •A JWKS you fetch from a live endpoint can rotate over time — if a token that used to verify suddenly doesn't, check whether the JWKS has published a new key set since you last fetched it.
• •Once you have a PEM here, paste it straight into the JWT Verifier tool to confirm a real token actually verifies against this specific key.