JWK to PEM Converter (and back)
Identity providers publish their signing keys as a JWKS: a JSON document full of base64url numbers. Almost every library that verifies a token wants a PEM instead, and the two describe the same key in completely different shapes, so the gap has to be bridged by hand more often than it should be. This converts either way. Paste a JWK, a whole JWKS, or one or more PEM public keys, and each key comes back in the other form along with what it actually is: key type, RSA size or elliptic curve, the algorithm and use if the key declares them, and the RFC 7638 thumbprint — the canonical fingerprint that identifies a key regardless of which fields happen to travel with it. The conversion itself is done by the browser's own WebCrypto implementation rather than by hand-assembling ASN.1, so the bytes come from the same code that verifies signatures in your browser. Nothing is uploaded, and if a pasted JWK contains private key material the private members are dropped before anything else happens, with a note saying so.
Public keys only. Private members are dropped before the key is read, and nothing is uploaded.
Paste a JWK, a JWKS or a PEM public key to convert it.
How to use
- Paste a JWK, a JWKS document, or a PEM public key.
- Read the details: key type, size or curve, and the declared algorithm.
- Copy the PEM for a library that wants one, or the JWK for a JWKS.
- Use the thumbprint to check that two copies really are the same key.
- Paste several PEM blocks at once to convert a whole set.
Frequently asked questions
- What is the RFC 7638 thumbprint?
- A SHA-256 hash over a canonical JSON object containing only the members that define the key — for RSA that is e, kty and n, in that order, with no whitespace. Because everything else is excluded, two copies of the same key produce the same thumbprint even if one carries a kid, an alg and a use and the other does not.
- Is the thumbprint the same as the kid?
- Not necessarily. A kid is whatever the issuer chose to call the key, and it can be anything at all. Many issuers use the RFC 7638 thumbprint as the kid, which is why the two often match, but nothing requires it.
- Can I convert a private key?
- No. If a pasted JWK contains private members they are removed before the key is read, and only the public key is converted. Nothing is uploaded either way, but a private key does not belong in a web page.
- Which key types work?
- RSA and the NIST curves P-256, P-384 and P-521, plus Ed25519 where the browser supports it. Curves outside what WebCrypto implements — secp256k1, for instance — cannot be converted here.
- Why does the output JWK not have an alg?
- Because a PEM does not carry one. The importer has to be told an algorithm to read the key at all, so any alg in the result would be this tool's assumption rather than something the key stated, and it is removed instead.
- Is my key uploaded?
- No. The conversion runs in your browser using its built-in WebCrypto, and nothing is sent to a server.
Related tools
Base64 to Hex Converter (and back)
Convert a Base64 string to hexadecimal bytes and hex back to Base64, with URL-safe support, in your browser.
JWT Decoder
Decode a JSON Web Token to inspect its header, claims, and expiration.
JWT Generator
Build and sign HS256 / HS384 / HS512 JWTs from a header and payload — pairs with the JWT Decoder.
Punycode Converter
Convert internationalized domains between Unicode (`münchen.de`) and Punycode ASCII (`xn--mnchen-3ya.de`).
Base45 Encoder & Decoder
Encode text to Base45 and decode Base45 back to text, following RFC 9285, in your browser.
Quoted-Printable Encoder & Decoder
Encode text to MIME Quoted-Printable (RFC 2045) or decode it back — handling =XX escapes, soft line breaks, and UTF-8 — entirely in your browser, with 76-character line wrapping on encode.