PEM to JWK — Convert PEM Keys to JWK Format
Convert PEM-encoded cryptographic keys to JWK format. Supports RSA, EC, and Ed25519 keys — runs entirely in your browser, no upload.
PEM to JWK
Convert PEM-encoded public or private keys to JWK format. Works entirely in your browser.
PEM is the key format that has been with us since Privacy Enhanced Mail was proposed in 1993. It is the format of id_rsa, of cert.pem, of every BEGIN PUBLIC KEY block ever pasted into a server config. JWK is the key format of the JSON-first world — the format that OAuth 2.0 providers demand, that OpenID Connect discovery documents return, and that every JWT signing library in every language accepts as input. Converting between them is not a semantic transformation (the key material is the same) but a syntactic one: parse the ASN.1 DER structure inside the base64-encoded PEM armour, extract the key parameters, and reassemble them into the JSON structure defined by RFC 7517.
The ASN.1 parsing is the hard part. A PEM file is base64-encoded DER, and DER is a binary encoding of ASN.1 structures. An RSA private key PEM contains a version number, the modulus n, the public exponent e, the private exponent d, and the CRT parameters (p, q, dp, dq, qinv). An EC private key PEM contains the curve OID and the private scalar. The tool unwraps all of these from their ASN.1 containers and maps them to the corresponding JWK member names — n, e, d for RSA, crv, x, y, d for EC — with the key type kty set accordingly.
The practical use case is OAuth 2.0 client registration. When you register an OAuth client that uses private-key JWT authentication (RFC 7523), the authorization server asks for your public key as a JWK. You have the key as a PEM file on disk. The converter bridges the two formats in one paste operation, and the auto-generated key ID (RFC 7638 thumbprint) gives you the kid value to include in your JWT header.
How to use
Paste a PEM key
Paste your PEM-encoded public or private key (RSA, EC, or Ed25519) into the input. The tool parses the ASN.1 DER structure inside the PEM wrapper and extracts the key parameters.
Review the JWK output
The JWK is displayed as formatted JSON with the standard key-type members: kty, n, e for RSA; kty, crv, x, y for EC; kty, crv, x for Ed25519. The key ID (kid) is auto-generated from the key material.
Copy the JWK
Copy the JWK to your clipboard for use in JWT signing libraries, OAuth 2.0 client configuration, or OpenID Connect provider metadata. The output conforms to RFC 7517.
Frequently asked
Which key types are supported?
RSA (2048-bit and 4096-bit public and private keys), EC (P-256, P-384, P-521 curves on the secp256r1/secp384r1/secp521r1 curves), and Ed25519 (public and private, RFC 8037). Legacy DSA keys and encrypted PEM files are not supported.
Does the tool expose the private key in the JWK output?
If you paste a PEM private key, the output JWK includes the private key component (d for RSA/EC, d for Ed25519). The private key is shown only in your browser and never leaves your device. For public-key-only output, paste a PEM public key.
How is the key ID (kid) generated?
The kid is a SHA-256 thumbprint of the public key component per RFC 7638. This produces a deterministic, collision-resistant identifier that is consistent across repeated conversions of the same key. If the input is a private key, the kid is still computed from the public component only.
Can I convert a certificate PEM to JWK?
No — this tool converts raw key PEMs, not X.509 certificate PEMs. To convert a certificate's public key to JWK, extract the key from the certificate first using the SSL Certificate Decoder tool, then paste the extracted key PEM here.
Why would I need JWK format instead of PEM?
JWK is the native key format for JSON-based protocols: JWT signing libraries, OAuth 2.0 client registration, OpenID Connect discovery documents, and AWS KMS key policies. PEM is the filesystem format; JWK is the API format. Most cloud services that accept cryptographic keys accept JWK.
Limitations
- No encrypted PEM supportPassword-protected PEM files (with Proc-Type: 4,ENCRYPTED headers) are not supported. Decrypt the PEM with OpenSSL first, then paste the decrypted key.
- No DSA or classic Diffie-HellmanOnly RSA, EC, and Ed25519 key types are supported. DSA, DH, and other legacy key types are rejected with a message indicating the unsupported key algorithm.
- No JWK Set (JWKS) outputThe tool outputs a single JWK, not a JWK Set containing multiple keys. For JWKS output (required by OIDC discovery), concatenate the individual JWKs into a JSON array with a `keys` wrapper.
Platform notes
- macOS
- For command-line conversion, `pem-jwk` (via npm) converts PEM to JWK. The browser tool is the right pick for one-off conversions of keys pasted from a chat or documentation.
- Linux
- OpenSSL's `-pubout` and manual extraction can get you the parameters, but the JWK JSON assembly is manual. The browser tool does the entire PEM-to-JWK conversion in one step.
- Web
- Runs entirely client-side. Private keys are never uploaded — the conversion happens in your browser's memory.