Cryptobench

Inspector

Paste an opaque token. Receive an explanation.

Layer by layer — structure, key, signature, freshness — with each finding stated plainly.

inspected and discarded; nothing pasted here is stored
Try a sample:each is signed on request, so it can be checked against a real key

Input

Artifact

nothing pasted

A URL is also accepted: the keys are fetched from it as your own application would fetch them. Nothing is stored. Use test keys only.

Report

Verdict per layer

Nothing pasted yet. Paste a token above, or begin with one of the samples: each arrives with the key that judges it, so the first click ends in a verdict.

Reference

URL or embedded key?

Your app needs the public key to check a token. It can fetch it from a URL at runtime, or carry it as a file. Both are normal. The trade is always the same one: who controls rotation.

Fetch from the URLEmbed the key
RotationAutomatic on next fetchNeeds a redeploy
NetworkDepends on the URLNone
TrustWhatever the endpoint servesPinned to one key
SuitsA signer that rotates keysOffline, air-gapped, or pinned

Use the URL when the signer rotates its keys, which is what every identity provider does. That is why it became the norm, and it is usually a one-line config change.

Embed the key when you cannot make a network call while checking a token, or when you want your app pinned to one key so a compromised endpoint could not introduce another. Export the PEM from the Keysets tab.

One catch worth knowing: Spring Boot's public-key-location only loads RSA keys. An ES256 or EdDSA key needs a custom decoder, or the URL.