JWK to PEM Converter
Convert JWK to PEM (SPKI/PKCS#8) and back for RSA, EC (P-256/384/521), Ed25519 and X25519 keys, via Web Crypto's own import/export for standards-correct DER.
Keys are converted with the Web Crypto API. Keep private keys secret.
What this JWK ↔ PEM converter does
Paste a JWK (JSON Web Key) to get a PEM block, or switch direction and paste a PEM to get a JWK back. It handles RSA keys (kty RSA), EC keys (kty EC on the P-256, P-384 and P-521 curves) and OKP keys (kty OKP on Ed25519 and X25519), public and private. Public keys are written as SPKI (-----BEGIN PUBLIC KEY-----) and private keys as PKCS#8 (-----BEGIN PRIVATE KEY-----). Under the hood each key is imported and re-exported with your browser's built-in Web Crypto API, so the DER inside the PEM is standards-correct rather than hand-assembled — the bytes match exactly what crypto.subtle.exportKey produces. After each conversion a line above the result says what the key is — its type with the curve or the RSA key size, public or private, the alg it names and its kid.
Why convert between JWK and PEM
JWKS endpoints, OIDC discovery documents and most JWT libraries hand you keys as JWK, while OpenSSL, TLS configs, SSH tooling and many server libraries expect PEM — so you constantly need to move a key from one shape to the other. This converter bridges the two without a round-trip through the command line. It runs entirely in your browser: nothing you paste is uploaded, logged or stored, which matters because private keys must stay secret. Note the scope: it reads SPKI public keys and PKCS#8 private keys (the modern -----BEGIN PUBLIC/PRIVATE KEY----- labels), not the legacy PKCS#1 -----BEGIN RSA ...----- or SEC1 -----BEGIN EC PRIVATE KEY----- forms, and among OKP keys it supports Ed25519 and X25519 — not Ed448 or X448.
Frequently asked questions
Which key types and PEM formats are supported?
RSA keys, EC keys (curves P-256, P-384 and P-521) and OKP keys (Ed25519 and X25519). Public keys convert to and from SPKI (-----BEGIN PUBLIC KEY-----) and private keys to and from PKCS#8 (-----BEGIN PRIVATE KEY-----). Legacy PKCS#1 (-----BEGIN RSA PUBLIC/PRIVATE KEY-----) and SEC1 (-----BEGIN EC PRIVATE KEY-----) blocks are not supported, and of the OKP curves, Ed448 and X448 are refused.
How does it decide whether a key is public or private?
Converting JWK to PEM, a JWK that contains the private component d is treated as private and written as PKCS#8; otherwise it is public and written as SPKI. Converting PEM to JWK, the -----BEGIN ...----- label decides: PUBLIC KEY is read as SPKI, PRIVATE KEY as PKCS#8.
Can I paste a whole JWKS, or get a kid on the JWK?
Yes. A pasted key set is read and, when it holds more than one key, a picker lets you choose which to convert. Going from PEM to JWK, a checkbox adds a kid computed as the key's RFC thumbprint, and PKCS#1 or SEC1 blocks are named with the one-line openssl command that converts them.
Can it convert Ed25519 keys, set alg and use, or give me the public half of a private key?
Yes. OKP keys on Ed25519 and X25519, public and private, convert in both directions; Ed448 and X448 are refused. Going from PEM to JWK, an "alg (algorithm)" select and a "use (purpose)" select write those members onto the JWK — both are "Leave out" by default — and an alg the key cannot do, or a use that contradicts the alg or the key, is refused with a sentence saying why. Converting a private key either way also shows its public half in a box of its own, with "Copy public key" and "Download public key".
Can it tell me what a key is, or copy it ready for a JWKS endpoint?
Yes. After a conversion, a line above the result gives the key’s Type — the curve, such as EC P-256, or an RSA key’s size in bits — whether it is a public or private key, its Algorithm (or “not stated in the key”) and its Key ID (or “none”), read from the key’s own members. Going from PEM to JWK, “Copy as JWKS” copies the JWK wrapped as a key set, {"keys":[…]}; for a private key the button reads “Copy public key as JWKS” and copies only the public half, since a key set is what gets published.