Signs and verifies PIX (SPI) messages using JSON Web Signature (JWS). PIX is Brazil's instant payment system. Messages are signed with ECDSA (ES256) or RSA (RS256) and transmitted as JWS compact serialization.
Inputs
Tab: Sign a PIX payload or Verify an existing JWS.
Algorithm: JWS signing algorithm. Section 4.2 of the Manual de Segurança do SFN recommends the RSA-PSS pair and forbids the HMAC family and "none".
Private Key: Signing key: ECDSA private key (hex) for ES256, or RSA private key (PEM) for PS256, PS512 and RS256.
KID: Key ID header value — names the key inside the JWK Set that jku points at.
JKU: URL of the JWK Set holding the signing key, which must live on the CERTQRC site. Without it kid has nothing to resolve against.
X5T: base64url thumbprint of the signing certificate, tying the signature to a certificate the receiver can check.
Payload: JSON payload to sign (the PIX message body).
Tips
Section 4.2 requires alg, kid, jku and a thumbprint (x5t or x5t#S256) at minimum — a header with only kid is well formed but not conformant, and the tool reports which fields are missing.
PS256 and PS512 are the recommended algorithms; ES256 and RS256 are accepted but flagged in the conformance report.
The JWS compact format is: header.payload.signature (base64url encoded).
typ is JWS rather than JWT: the payload is a payment document, not a set of JWT claims.
Standards: RFC 7515 (JWS), RFC 7518 (JWA), Manual de Segurança do SFN Vol. II, section 4.2