JWKS Verifier
Inspect any JSON Web Key Set — from Keycloak, Phase Two, or any OpenID Connect provider. See every key's ID, type, size, thumbprint, and certificate, catch weak or expired keys, and verify a JWT signature against the set — all in your browser.
A JWKS URL, a Keycloak realm URL, or an OIDC discovery URL (its jwks_uri is followed).
Paste a JWT to find the key its kid points to and check the signature against the key set.
What is a JWKS?
A JSON Web Key Set (JWKS) is how an identity provider publishes the public keys that verify its tokens. It is a JSON object with a keys array; each entry is a JSON Web Key (JWK) with a key type (kty), a key ID (kid), usually an intended use (use) and algorithm (alg), the public key parameters (n and e for RSA, crv, x, and y for elliptic curves), and sometimes an X.509 certificate chain (x5c).
When your application receives a token, it reads the kid from the token header, finds the key with the same kid in the issuer's JWKS, and checks the signature. Because only public keys are published, anyone can verify tokens but only the issuer can sign them.
The Keycloak JWKS endpoint
Every Keycloak realm serves its keys at /realms/{realm}/protocol/openid-connect/certs and advertises that URL as jwks_uri in its discovery document. A default realm publishes an RS256 signing key and an RSA-OAEP encryption key, each with a self-signed certificate whose subject is the realm name. You can see and manage the same keys in the admin console under Realm settings → Keys: the Keys list tab shows each key's kid, algorithm, and status, and the Providers tab is where keys are generated, imported, and prioritized.
Key rotation without breaking tokens
Rotation works because a JWKS can hold several keys at once. Clients cache the set and refetch it when they see an unknown kid, so a safe rotation looks like this:
- Publish the new key. In Keycloak, add a key provider (for example rsa-generated) with a higher priority than the current one. New tokens are signed with the active key of the highest priority.
- Keep the old key published. Tokens signed with it keep verifying until they expire — leave it enabled for at least the longest token or session lifetime.
- Retire it. Mark the old provider passive (it verifies but never signs), then disable or delete it once nothing signed with it is still in use.
Paste a token into the verifier above to see which key it was signed with — a token whose kid is no longer in the set is the classic symptom of a key removed too early.
What this tool checks
- Missing or duplicate
kidvalues, which make key selection ambiguous. - RSA keys shorter than 2048 bits, mismatched
algandkty, and keys withoutuseoralg. - Expired, not-yet-valid, or soon-to-expire
x5ccertificates, andx5t#S256values that do not match the certificate. - Private key material (
d,p,q, or symmetrick) that must never be published.
To check the rest of a provider's configuration — issuer, endpoints, PKCE support, and algorithms — use the OIDC Discovery Inspector. To read a token's claims, use the JWT Decoder.
Learn more
- JWT security best practices — algorithms, expiry, revocation, and key handling.
- Decoding JWT structure — what the header's
algandkidmean. - Keycloak overview — how Phase Two and Keycloak issue and sign tokens.
Frequently asked questions
What is a JWKS?
A JSON Web Key Set (JWKS, RFC 7517) is a JSON document with a keys array, where each entry is a JSON Web Key (JWK) describing one public key. Identity providers publish their JWKS at a jwks_uri so applications can verify the signatures on ID tokens and access tokens without sharing any secret.
Where is the Keycloak JWKS endpoint?
Every Keycloak realm publishes its public keys at https://your-host/realms/{realm}/protocol/openid-connect/certs (older deployments add an /auth prefix). The same URL is advertised as jwks_uri in the realm's /.well-known/openid-configuration document. You can paste the realm URL into this tool and it will find the certs endpoint for you.
What does kid mean?
kid is the key ID. A signed JWT carries the kid of the key that signed it in its header, and verifiers look up the key with the same kid in the JWKS. Without unique kids, a verifier cannot reliably pick the right key when more than one is published — which is exactly what happens during key rotation.
Why does my JWKS contain a key with use "enc"?
Keys marked use: enc are for encryption, not signing. Keycloak publishes an RSA-OAEP encryption key alongside its signing keys so clients can encrypt data (for example, encrypted ID tokens) to the realm. Signature verification should only use keys with use: sig, or keys without a use.
Is it safe to paste my keys and tokens here?
Yes. A JWKS only contains public keys, and all analysis and signature verification happens in your browser with WebCrypto. Nothing is sent to Phase Two. If you enter a URL, your browser fetches it directly from that server. If the tool finds private key material in the set, it flags it as an error — a published JWKS must never contain it.
What is a JWK thumbprint?
A JWK thumbprint (RFC 7638) is a SHA-256 hash of a key's required public members in a canonical order. It is a stable fingerprint of the key itself, independent of kid or other metadata, which makes it useful for pinning and for comparing keys across environments.
Why does fetching a JWKS URL fail in the browser?
Browsers only let a page read a cross-origin response when the server sends CORS headers. Keycloak's certs endpoint sends them for any origin, so a failure there usually means a wrong realm name (Keycloak's 404 has no CORS headers), a proxy or WAF stripping headers, or a network problem. Other providers may not allow browser requests at all. Either way, you can open the URL in a tab and paste the JSON instead.
How do I rotate keys in Keycloak?
Add a new key provider under Realm settings → Keys → Providers with a higher priority than the current one. Keycloak signs new tokens with the active key of the highest priority, while older keys stay published so existing tokens still verify. Once those tokens have expired, set the old key to passive (still verifies, never signs) and later disable or delete it.
Can I share a link to a result?
Yes. After a fetch, use Copy share link. The link looks like /tools/jwks-verifier#url=https%3A%2F%2Fissuer.example.com%2Frealms%2Fdemo%2Fprotocol%2Fopenid-connect%2Fcerts and re-runs the check when opened. Only the JWKS URL is included — never a token or pasted JSON — and it sits in the URL fragment (after #), which browsers do not send to the server, so it does not end up in server logs.