Inspect any JWKS — every key decoded, never leaves the browser.
Paste a JWKS URL or raw JSON. See kid, alg, use, key type, modulus length, EC curve, and x5c chain — all decoded via WebCrypto. Zero network calls during analysis.
Paste JWKS. Inspect every key.
Choose a source below. URL fetch is attempted with fetch() — if the endpoint blocks CORS, switch to raw JSON paste. No key material is stored or transmitted.
Access-Control-Allow-Origin: * for browser fetch to work. If it returns a CORS error, switch to "Paste raw JSON."curl <url> | jq .) and paste it above.Open DevTools (F12 or Cmd+Option+I), click the Network tab, switch to "Paste raw JSON," reload and paste a JWKS. Watch the Network tab — no requests fire during analysis. Key metadata is extracted via crypto.subtle.importKey(), which runs in the browser's cryptographic engine, not over the network. If you see any outbound request after the page finishes loading, that is a bug — report it to [email protected].
Debugging JWKS by hand is the status quo.
An OpenID Connect n field is a base64url-encoded big integer that tells you nothing until decoded — is it a 2048-bit key or a 4096-bit key? Does the kid match what's in your JWT header? Is the use field sig or enc? Developers working a live auth incident typically answer these questions with a throwaway Node script or by hand-decoding base64 in a terminal.
This tool extracts all of that in one paste. The x5c chain, if present, is decoded from base64 DER and presented in summary — subject, issuer, validity dates — without requiring openssl x509 in a terminal.
You're hand-inspecting JWKS, which means your auth configuration has gaps that a systematic review would catch. Septim Audit is a 10-lens teardown of your stack — auth config, key rotation policy, token lifetime, CORS headers, and seven more — delivered in writing, once, $99.
Septim Audit — $99 →