JWK to PEM Converter (RSA, EC, Ed25519)
Converts between JWK (JSON Web Key) and PEM (SPKI for public keys, PKCS#8 for private keys). The direction is detected from what you paste, and everything runs on the browser built-in Web Crypto API, so your keys are never sent to a server. To create a new key, use the Key Pair Generator; to inspect a token, use the JWT Decoder.
🔒 Runs in your browser · Your data is never sent to a server
How to use
- Paste the key you want to convert into the "PEM or JWK" field.
- The tool detects whether it is PEM or JWK and shows the other format in "Result".
- Copy it or save it as a file.
Notes
- A pasted private key is shown in plain text on screen. Do not use this on a shared device or while screen sharing. Input is processed only in this browser and is not stored.
- Only BEGIN PUBLIC KEY (SPKI) and BEGIN PRIVATE KEY (PKCS#8) PEM are supported. BEGIN RSA PRIVATE KEY (PKCS#1), BEGIN EC PRIVATE KEY (SEC1), and passphrase-encrypted PEM are not; convert them to PKCS#8 with OpenSSL first.
- Supported keys are RSA, EC (P-256/P-384/P-521), and Ed25519. Curves the browser Web Crypto API cannot handle, such as secp256k1, are not supported. Ed25519 works only in recent browsers.
- For JWK to PEM, a JWK with d produces a private key (PKCS#8) and one without produces a public key (SPKI). Metadata such as alg, use, and kid is lost because PEM cannot carry it. For a JWKS (a keys array), only the first key is converted.
Glossary
JWK
A JSON representation of a cryptographic key (RFC 7517). It holds kty (key type) and values such as n, e, x, y, and d as Base64URL. Public keys for verifying JWTs are often published as a JWKS.
PEM / SPKI / PKCS#8
PEM wraps DER binary data in Base64 and header lines. Public keys are stored as SPKI (SubjectPublicKeyInfo) and private keys as PKCS#8.
kty / crv
JWK fields that identify the key type. kty is RSA, EC, or OKP; for EC and OKP, crv names the curve (P-256, Ed25519, and so on).
FAQ
Can it convert "RSA PRIVATE KEY" or "EC PRIVATE KEY" PEM?
No. Only PKCS#8 ("BEGIN PRIVATE KEY") and SPKI ("BEGIN PUBLIC KEY") are handled. For PKCS#1 or SEC1 keys, first convert to PKCS#8 with something like openssl pkcs8 -topk8 -nocrypt.
Why do alg and kid disappear when I convert JWK to PEM?
PEM stores only the key material, so it cannot carry JWK metadata such as alg, use, or kid. Converting back from PEM to JWK does not restore them either.
How can it convert without me choosing the algorithm?
A JWK states its type through kty and crv. For PEM, the type is encoded inside the data, so the tool tries RSA, EC (P-256/P-384/P-521), and Ed25519 in turn and uses the one that loads.
Is a pasted private key sent anywhere or stored?
No. Conversion uses only the Web Crypto API in your browser; nothing is sent to a server and the input is not saved in the browser. The key is shown in plain text on screen, though, so be careful while screen sharing.
Share this page