Cryptobench

Cryptographic test bench

Produce the counterparty's artifact, and integrate on your own schedule.

Sign, verify, encrypt and decrypt real JOSE and OpenPGP artifacts with keys entirely under your control. Your handler enters integration before the counterparty is ready, and faults surface days ahead of release rather than during it. Nothing about release day is a first.

Enter the benchExplore the protocols

Or take a token apart now. No account required.

Sign · JOSE · ES256

PASS

claims.json

{ "sub": "acct_8812", "scope": "billing.read",
"exp": 1786400000 }
artifact

eyJhbGciOiJFUzI1NiIsImtpZCI6ImJpbGwtMDIifQ.eyJzdWIiOiJhY2N0Xzg4MTIiLCJzY29wZSI6ImJpbGxpbmcucmVhZCJ9.MEUCIQDf3s9Xk2v0oQ7pR1mYb8cN

01 · Emit

Take the counterparty's side

Generate the signed or encrypted payload your service expects to receive, including the malformed variants no library will produce for you.

02 · Verify

Take the recipient's side

Present what your service produced and receive a verdict for each layer: structure, key, signature, freshness. Not a single yes or no.

03 · Keep

Settle them into fixtures

Keep key sets, cases and expected verdicts in a project, and CI runs exactly what runs on your machine.

Protocols

SEE ALL →

JOSE

JWT JWS JWE

OpenPGP

PGP GPG .gpg .asc

X.509 / mTLS

IN PIPELINE

COSE

IN PIPELINE

Reference

URL or embedded key?

Your app needs the public key to check a token. It can fetch it from a URL at runtime, or carry it as a file. Both are normal. The trade is always the same one: who controls rotation.

Fetch from the URLEmbed the key
RotationAutomatic on next fetchNeeds a redeploy
NetworkDepends on the URLNone
TrustWhatever the endpoint servesPinned to one key
SuitsA signer that rotates keysOffline, air-gapped, or pinned

Use the URL when the signer rotates its keys, which is what every identity provider does. That is why it became the norm, and it is usually a one-line config change.

Embed the key when you cannot make a network call while checking a token, or when you want your app pinned to one key so a compromised endpoint could not introduce another. Export the PEM from the Keysets tab.

One catch worth knowing: Spring Boot's public-key-location only loads RSA keys. An ES256 or EdDSA key needs a custom decoder, or the URL.