What to paste for the public key or certificate is vague

[heaths]

In the placeholder text for https://jwt.io, the public key states,

Public key or certificate. Enter it in plain text only if you want to verify a token.

As to what "plain text" is in this context isn't clear.

While trying to help a Key Vault customer, I originally tried a base64url-encoded key would work since everything else was base64url-encoded. When that didn't work and I was sure my sample was correct, I tried both base64 and PEM using the common "PUBLIC KEY" label for PKCS#8-encoded keys. It wasn't until I switched over to using a certificate with the "CERTIFICATE" PEM label that worked when I thought to try the PKCS1, RSA-only "RSA PUBLIC KEY".

It would be great if either the placeholder text or some link to more info could clarify this. I spent more time than I care to admit trying to figure out what to paste in that textarea or if my code was wrong.

[panva]

@heaths #553 updated the placeholder texts for both public and private key inputs

Public Key: Public Key in SPKI, PKCS #1, X.509 Certificate, or JWK string format. Private Key: Private Key in PKCS #8, PKCS #1, or JWK string format.

That means

Public Key with labels "PUBLIC KEY", "RSA PUBLIC KEY", "CERTIFICATE" Private Key with labels "PRIVATE KEY", "RSA PRIVATE KEY"

553 also adds support for JSON Web Key (JWK) format, it expects a JSON String such as

// public key

{"crv":"P-256","x":"EVs_o5-uQbTjL3chynL4wXgUg2R9q9UU8I5mEovUf84","y":"kGe5DgSIycKp8w9aJmoHhB1sB3QTugfnRWm5nU_TzsY","kty":"EC"}

// private key

{"crv":"P-256","x":"EVs_o5-uQbTjL3chynL4wXgUg2R9q9UU8I5mEovUf84","y":"kGe5DgSIycKp8w9aJmoHhB1sB3QTugfnRWm5nU_TzsY","d":"evZzL1gdAFr88hb2OF_2NxApJCzGCEDdfSp6VQO30hw","kty":"EC"}

newlines for readability are allowed, likewise, for PEM format newlines in the base64 portion are allowed. newlines after the opening label and before closing label for PEM formats are required.

[heaths]

Looks great. Thanks!

[DanOnCall]

Re-opening this issue to include this guidance in the next version of jwt.io :)