JWK ↔ PEM Converter
Convert RSA and EC keys between JWK (JSON Web Key) and PEM format entirely in your browser, with an RFC 7638 thumbprint shown for every key.
How to use the JWK ↔ PEM Converter
- Paste a JWK into the left panel to generate a matching PEM key on the right, or paste a PEM key into the right panel to generate a matching JWK on the left.
- Both panels stay live and editable — keep typing in either one and the other updates automatically a moment after you stop.
- Once a JWK is present, its RFC 7638 thumbprint appears below the JWK panel.
- Copy or download either panel's contents with its dedicated buttons.
- For a successfully converted public key, click JWT Decoder below the PEM panel to send it straight to that tool's signature verification field.
See it in action
Given this EC (P-256) public JWK:
{
"kty": "EC",
"x": "Us_bTvyo12aKkEhzNsvRcn5_tXS6WvLBPpRNEbIzeLU",
"y": "sEX3aSBPotzL0M_TJf3MVFZH89WXys4vGc3rhNQoKXA",
"crv": "P-256"
}
The converter produces this PEM public key:
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUs/bTvyo12aKkEhzNsvRcn5/tXS6
WvLBPpRNEbIzeLWwRfdpIE+i3MvQz9Ml/cxUVkfz1ZfKzi8ZzeuE1CgpcA==
-----END PUBLIC KEY-----
...with a thumbprint of vwm1Bede0YwI_Os3TlhpE3THt47Yi8Ux3rJQ8oxzGHI shown below the JWK panel.
How This Tool Works
Whichever panel you edit drives the other: paste or type a JWK (JSON Web Key) in the left panel to generate a matching PEM key on the right, or paste a PEM key on the right to generate a matching JWK on the left — there's no separate convert button. Nothing you paste is ever sent to a server; every conversion runs through your browser's built-in Web Crypto API.
Both RSA and EC (P-256, P-384, P-521) keys are supported, in both directions, for both public and private keys. Other key types — OKP (Ed25519/X25519) and symmetric (oct) keys — aren't supported, since neither has a standard PEM representation this converter can produce.
This converter accepts a single JWK object only, not a JWK Set (a { "keys": [...] } array, the shape returned by a real JWKS endpoint like /.well-known/jwks.json). If you have a JWKS response, pull out the one key object you need and paste just that.
A legacy PKCS#1 key (a PEM block starting with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN RSA PUBLIC KEY-----, the default output of `openssl genrsa`) is not converted — it shows a message pointing at `openssl pkcs8 -topk8 -nocrypt` to convert it to PKCS8 first. Browsers' Web Crypto API only supports the modern PKCS8/SPKI PEM formats natively.
Every successfully parsed JWK also shows its RFC 7638 JWK Thumbprint — a SHA-256 hash of the key's canonical public members, commonly used as the `kid` value in a JWKS. It's computed the same way for a public or private key, since the thumbprint is defined over the public portion only.
A JWK's own `alg` field (e.g. PS256, RSA-OAEP-256) is not carried forward, since PEM has no place to put it and a mismatched alg would otherwise cause conversion to fail even though the underlying key material is fine. Likewise, converting PEM to JWK never guesses an `alg`, `use`, or `key_ops` value — none of that is present in a PEM file, so none of it is fabricated in the output.
A successfully converted public PEM key can be sent directly to the JWT Decoder tool with one click, to verify a JWT signed with the matching private key — useful when you've just pulled a key out of a JWKS endpoint and want to check a token against it.