Public-key JWT verification

JWKS Validator

Verify a JWT against a trusted JSON Web Key Set by reading kid, selecting a compatible JWK and checking the signature in your browser.

JWT token

alg

—

kid

—

iss

—

Expected signing algorithm

JWKS URL (optional)

JWKS JSON

Expected issuer (optional)

Expected audience (optional)

Signature verification runs in your browser. Remote loading fetches only the JWKS URL you enter; the JWT is not sent to that endpoint or to a JWT verification API.

This tool never auto-follows token-supplied jku or x5u values. Treat the JWKS source as trusted configuration, not as something the untrusted token gets to choose.

How I validate a JWT with JWKS

I decode alg and kid, then select keys only from a JWKS I already trust for the expected issuer.

A matching kid is only a selection hint; algorithm, key use and issuer trust still matter.

1. Read alg + kid

Inspect the unverified JWT header.

2. Select a trusted JWK

Match kid and compatible key metadata.

3. Verify + validate

Verify the signature and then check time, issuer and audience rules.

Supported algorithms

RS256/384/512, PS256/384/512 and ES256/384/512 are supported through Web Crypto.

Why I do not automatically follow jku or x5u

Token-controlled key URLs can create SSRF and trust problems. Use a JWKS location bound to a trusted issuer.

Debug JWT kid →Debug issuer validation →Verify with PEM/secret →

Advanced JWT and identity tools

OIDC Discovery Checker

Check OpenID Connect or OAuth authorization-server metadata from an issuer URL, validate exact issuer matching and inspect JWKS and endpoint metadata in your browser.

JWK Inspector

Inspect a single JSON Web Key, identify key type and usage metadata, detect private key material and compute an RFC 7638 SHA-256 JWK thumbprint locally.

Recommended JWKS validation guides

When JWKS-based verification fails, these are the guides I check next.