JWKS Explorer & JWK to PEM Converter

What is a JWKS?

A JSON Web Key Set (RFC 7517) is a JSON document listing one or more public keys an authorization server uses to sign tokens. OpenID Connect and OAuth 2.0 authorization servers publish theirs at a jwks_uri, discoverable from /.well-known/openid-configuration. See the OIDC discovery explorer.

How does key rotation work?

Authorization servers periodically introduce new signing keys and retire old ones. Without rotation, a single compromised key stays trusted forever (see why signing key rotation matters). Well-behaved clients handle this by refetching the JWKS (respecting cache headers) when they see a kid they don't recognize, rather than hardcoding keys. IdentityServer supports fully automatic key management and rotation. See automatic key management in IdentityServer.

How does kid matching work?

Each JWT's header (visible in the JWT decoder) carries a kid claim identifying which key in the JWKS signed it. Use the "Match a JWT" box above to find the matching key for a token without leaving this page. A missing or unmatched kid usually means every key compatible with the token's alg has to be tried instead, a sign of a less careful key rotation setup.

JWK vs. PEM

A JWK is JSON; a PEM is the base64 + header/footer text format used by OpenSSL and most non-JOSE tooling. This tool converts any public key it loads into an SPKI PEM using the Web Crypto API's importKey/exportKey, never a custom crypto implementation. Each key card also shows an RFC 7638 SHA-256 thumbprint, a stable short fingerprint for comparing or referencing a key independent of its kid. If a JWKS contains private key fields (d, p, q), that's a critical misconfiguration: rotate that key immediately.

Fetching a JWKS in .NET

Microsoft.IdentityModel.Tokens.JsonWebKeySet parses a JWKS document directly:

using Microsoft.IdentityModel.Tokens;

var client = new HttpClient();
var json = await client.GetStringAsync("https://your-issuer/.well-known/jwks.json");
var jwks = new JsonWebKeySet(json);

foreach (var key in jwks.Keys)
    Console.WriteLine($"{key.Kid}: {key.Kty} / {key.Alg}");

In most ASP.NET Core apps you never do this manually: the JWT Bearer and OpenID Connect handlers fetch and cache the JWKS automatically from the discovery document.