Fetch a public verification key from a JWKS endpoint (or via OIDC discovery) and emit it as PEM.
jwksfetch is a single Native AOT executable (no .NET runtime required) that retrieves a public
JSON Web Key from a remote JWKS endpoint or via OIDC discovery, then emits the key in PEM format
to stdout. Designed as a companion to jwtdecode: pipe jwksfetch output directly into
jwtdecode --verify --key-file - for end-to-end offline JWT verification after an initial key fetch.
| Publisher | ShikeChen |
|---|---|
| Version | 1.2.2 |
| License | MIT |
| Installer type | portable |
| Architecture | x64, arm64 |
| Package ID | ShikeChen.JwksFetch |
winget install --id=ShikeChen.JwksFetch -ewinget upgrade --id=ShikeChen.JwksFetch -ewinget uninstall --id=ShikeChen.JwksFetch -eJwksFetch adds this command to the command line: jwksfetch.
Yes. JwksFetch is free and open-source software released under the MIT license.
The latest version is 1.2.2.
The download button links to the official installer published on github.com, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with ffbe92ad58a2d1877df919c20b5d2792c0cd88768dcdea7f05de51b69aca4c84.
JwksFetch runs on Windows and is available for 64-bit (x64), ARM64 systems.
Open Settings › Apps › Installed apps, find JwksFetch and select Uninstall. From the command line, run winget uninstall --id=ShikeChen.JwksFetch -e.
Yes. JwksFetch is available as a portable program (jwksfetch-1.2.2-win-x64.exe, 64-bit (x64)) that runs without installation. Copy it to any folder or USB drive and run it from there.
Other Encryption programs for Windows from different developers.
OpenSSL: A Key Tool for Digital Security
GNU Privacy Guard (GnuPG or GPG) is a free-software replacement for Symantec's PGP cryptographic software suite.
Encryption made easy and optimized for the cloud
A filesystem in userspace (FUSE) with transparent encryption (when writing) and decryption (when reading).
Disk Encryption Software
Cryptographic protocol analysis for real-world cryptographic protocols.
Offline JWT decoder and (optional) signature verifier — single native exe, no runtime needed.