What a JWK actually is, and why the fields change by key type

A JSON Web Key is a standard JSON representation of a cryptographic key, and its structure genuinely depends on the key type: an RSA key is represented by its modulus and exponent (`n` and `e`), an elliptic curve key by its curve name and point coordinates (`crv`, `x`, `y`), and a symmetric key by the raw key bytes themselves (`k`). This isn't incidental complexity — it reflects the fact that these are fundamentally different mathematical objects, and a JWK document has to be able to represent whichever one is actually in use, which is why the "type-specific fields" shown here change depending on the `kty` value of each key.

A JWKS (JSON Web Key Set) is simply a `{"keys": [...]}` wrapper around multiple JWKs — the format an OAuth/OIDC provider publishes at its `/.well-known/jwks.json` endpoint so clients can fetch the current set of public keys used to verify tokens it issues.

Why the "oct" key type gets a specific warning

For RSA and EC keys, the fields typically shown in a JWK are the public half — safe to publish, since deriving the private key back out isn't computationally feasible. A symmetric ("oct") key is different in kind: the `k` field is the entire secret, not a derived public value, so displaying it is exactly equivalent to displaying a plaintext password. This tool flags that distinction explicitly rather than treating every key type's fields identically, since pasting a real symmetric production key into any browser-based tool — even one that, like this one, never transmits it anywhere — is worth pausing on before doing.