JWK to PEM Converter — RSA & EC, Both Directions
Convert keys between JWK and PEM (SPKI / PKCS#8) in both directions, for RSA and EC — handy when wiring up JWT, OIDC and JWKS. Free, no upload.
🔒 Keys are converted in your browser with the Web Crypto API — nothing is uploaded. Keep private keys secret.
What this JWK ↔ PEM converter does
Paste a JWK (JSON Web Key) to get a PEM block, or switch direction and paste a PEM to get a JWK back. It handles both RSA keys (kty RSA) and EC keys (kty EC on the P-256, P-384 and P-521 curves), public and private. Public keys are written as SPKI (-----BEGIN PUBLIC KEY-----) and private keys as PKCS#8 (-----BEGIN PRIVATE KEY-----). Under the hood each key is imported and re-exported with your browser's built-in Web Crypto API, so the DER inside the PEM is standards-correct rather than hand-assembled — the bytes match exactly what crypto.subtle.exportKey produces.
Why convert between JWK and PEM
JWKS endpoints, OIDC discovery documents and most JWT libraries hand you keys as JWK, while OpenSSL, TLS configs, SSH tooling and many server libraries expect PEM — so you constantly need to move a key from one shape to the other. This converter bridges the two without a round-trip through the command line. It runs entirely in your browser: nothing you paste is uploaded, logged or stored, which matters because private keys must stay secret. Note the scope: it reads SPKI public keys and PKCS#8 private keys (the modern -----BEGIN PUBLIC/PRIVATE KEY----- labels), not the legacy PKCS#1 -----BEGIN RSA ...----- or SEC1 -----BEGIN EC PRIVATE KEY----- forms, and it supports RSA and EC — not OKP curves such as Ed25519.
Frequently asked questions
Which key types and PEM formats are supported?
RSA and EC keys (curves P-256, P-384 and P-521). Public keys convert to and from SPKI (-----BEGIN PUBLIC KEY-----) and private keys to and from PKCS#8 (-----BEGIN PRIVATE KEY-----). Legacy PKCS#1 (-----BEGIN RSA PUBLIC/PRIVATE KEY-----) and SEC1 (-----BEGIN EC PRIVATE KEY-----) blocks are not supported, and OKP keys such as Ed25519 are out of scope.
Is my private key uploaded anywhere?
No. The conversion runs entirely in your browser using the Web Crypto API. Keys are never sent to, logged by, or stored on any server — they exist only in your browser tab. Still, treat any private key you paste with care.
How does it decide whether a key is public or private?
Converting JWK to PEM, a JWK that contains the private component d is treated as private and written as PKCS#8; otherwise it is public and written as SPKI. Converting PEM to JWK, the -----BEGIN ...----- label decides: PUBLIC KEY is read as SPKI, PRIVATE KEY as PKCS#8.