JWKS Inspector & Key Extractor
JWKS Inspector & Key Extractor: Parses modulus (n) and exponent (e) BigInt components and reconstructs ASN.1 DER / PEM public key blocks.
About this jwks inspector & key extractor
JWKS Inspector & Key Extractor — browser-based utility.
How this tool works
Implements client-side JWKS Inspector & Key Extractor operations. Parses modulus (n) and exponent (e) BigInt components and reconstructs ASN.1 DER / PEM public key blocks specifically designed for a security engineer inspects an openid connect `/.well-known/jwks.json` key set and extracts public rsa pem keys.
- Credential & Payload Ingestion: Accepts raw request body strings, timestamp headers, and shared signing secrets.
- Canonical String Construction: Assembles the canonical signing payload (e.g. timestamp + '.' + body for Stripe signatures).
- Cryptographic Hash Evaluation: Uses Web Crypto subtle.sign with HMAC-SHA256 to compute the reference digest.
- Constant-Time Verification: Compares computed signature against received header using constant-time byte iteration.
Worked example
Scenario: A security engineer inspects an OpenID Connect `/.well-known/jwks.json` key set and extracts public RSA PEM keys.
Sample input:
Processing: Parses modulus (n) and exponent (e) BigInt components and reconstructs ASN.1 DER / PEM public key blocks.
Illustrative output:
Limits and verification
Requires exact raw byte representations of JSON bodies; any whitespace formatting change invalidates cryptographic HMAC signatures. Flags timestamp drift exceeding 5 minutes (300 seconds) to prevent replay attacks.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the JWKS Inspector & Key Extractor workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
What does JWKS Inspector summarize?+
It reads a JSON keys array and maps each item to kid, kty, use, alg and hasPrivateMaterial. Missing kid or kty become the literal marker (missing), and missing use or alg becomes unspecified.
What did the JWKS fixture verify?+
A public RSA signing key and an EC entry containing d produced two rows. The RSA row was not private, while the EC row was flagged hasPrivateMaterial true.
Which JWK validation is not performed?+
It does not validate base64url values, key parameters, curves, modulus size, certificates, thumbprints, key-operation consistency, duplicates, issuer provenance, JWKS HTTP cache headers or cryptographic usability.
Does a private-material flag make a key safe?+
No. The flag only checks whether d, p or q is truthy in submitted JSON. It does not protect the input, remove sensitive material, verify a key or establish secure publication.