Advanced JWT diagnostics
JWK Inspector
Inspect a single JSON Web Key, identify key type and usage metadata, detect private key material and compute an RFC 7638 SHA-256 JWK thumbprint locally.
What I check before I trust a JWK
A JWK can carry kty, kid, alg, use, key_ops and curve information, but those fields do not establish trust by themselves. I first confirm where the key came from.
The RFC 7638 thumbprint is useful for comparing keys, but it does not make an untrusted key trustworthy.
JWK inspection and thumbprint calculation run locally. Do not paste private or symmetric production keys when a public JWK is enough.
Related advanced tools
JWT Security Analyzer
Inspect a JWT for policy-sensitive security signals such as alg=none, unexpected algorithms, token-controlled key URLs, suspicious kid values, time claims, issuer and audience mismatches.
JWT Diff
Compare two JWTs field by field to see what changed in the decoded header and payload after refresh, login, environment changes or key rotation.
OIDC Discovery Checker
Check OpenID Connect or OAuth authorization-server metadata from an issuer URL, validate exact issuer matching and inspect JWKS and endpoint metadata in your browser.