Convert a JSON Web Key to PEM and back for RSA, EC and Ed25519 keys, with the thumbprint
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 16 Oct 2026.A JWK is a key written as JSON, used by JWTs, OAuth and OpenID Connect; PEM is the Base64 text form OpenSSL and servers use. Paste either one and it is converted to the other, for RSA, EC (P-256, P-384, P-521, secp256k1) and Ed25519 keys, with the RFC 7638 thumbprint, entirely in your browser.
Paste the JWK, a JWK Set from a jwks.json endpoint, or a PEM key or certificate.
The direction is detected: a JWK becomes PEM, a PEM becomes a JWK.
Choose the PEM format, such as PKCS#8 or PKCS#1, or tick Public key only to drop the private part.
Click Copy or Download; the RFC 7638 thumbprint is shown for each key.
JSON Web Keys and PEM files hold the same numbers in two wrappings. A JWK names each part, such as the modulus "n" and exponent "e" of an RSA key or the point "x" and "y" of an EC key, in Base64url. A PEM file holds the same values in DER, the binary format of X.509 and OpenSSL, inside BEGIN and END lines.
What it converts.
| Key | JWK to PEM | PEM to JWK |
|---|---|---|
| RSA public | SPKI or PKCS#1 | PUBLIC KEY, RSA PUBLIC KEY, certificate |
| RSA private | PKCS#8 or PKCS#1 | PRIVATE KEY, RSA PRIVATE KEY |
| EC P-256, P-384, P-521, secp256k1 | SPKI; PKCS#8 or SEC1 | PUBLIC KEY, PRIVATE KEY, EC PRIVATE KEY |
| Ed25519, Ed448, X25519, X448 | SPKI; PKCS#8 | PUBLIC KEY, PRIVATE KEY |
A JWK Set with several keys becomes several PEM blocks, and several PEM blocks become a JWK Set. Certificates and certificate requests give their public key.
Formats. SPKI ("PUBLIC KEY") and PKCS#8 ("PRIVATE KEY") work for every key type and are what most libraries expect. PKCS#1 ("RSA PUBLIC KEY", "RSA PRIVATE KEY") is the older RSA-only form; SEC1 ("EC PRIVATE KEY") is OpenSSL's older EC form.
Thumbprint. Each key's RFC 7638 thumbprint is shown: the SHA-256 of its required members in a fixed order, which many providers use as the "kid". Tick Add kid to put it into the JWK.
Private keys. Tick Public key only to drop the private members before publishing. When a private key does not carry its public part, it is worked out with the browser's own WebCrypto. Password-protected PEM files must be decrypted first.
The output was checked byte for byte against Node.js and OpenSSL for every supported key type, and against the examples in RFC 7517 and RFC 7638. Keys are never sent anywhere and nothing you paste is stored.
Paste the JWK into the box and the PEM appears at once: a PUBLIC KEY block for a public key, a PRIVATE KEY block for a private one. For RSA keys you can switch to the older PKCS#1 form, and for EC private keys to SEC1. A JWK Set with several keys gives one PEM block for each key.
Open the jwks.json address of the provider in your browser, copy the whole JSON and paste it here. Each key in the keys list becomes a PEM public key, labelled with its type, size and thumbprint, so you can match it with the kid in the header of the token you want to verify.
Both hold an RSA key. PKCS#1, labelled RSA PRIVATE KEY or RSA PUBLIC KEY, holds only RSA numbers. PKCS#8, labelled PRIVATE KEY, wraps any key type with an algorithm identifier, as SPKI does for public keys. Most modern libraries, including Java and Node.js, expect PKCS#8 and SPKI.
A short identifier computed from the key itself, defined in RFC 7638: the required members, such as e, kty and n for RSA, are written as JSON in alphabetical order without spaces and hashed with SHA-256. The same key always gets the same thumbprint, so it works well as a kid.
The conversion runs entirely in your browser; the key is not uploaded, logged or stored, and the page works offline once loaded. Even so, treat any private key with care and prefer converting test keys. When publishing, tick Public key only so the private members never appear in the output.
A JWK for an Ed448 or X448 private key must include the public key, and OpenSSL usually writes these PEM files without it. Working it out needs Ed448 maths that browsers do not provide. Export the key with its public part, or convert the public key separately.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about JWK to PEM Converter and anybody who knows can answer. No account needed.
On the related tools: TSV to JSON – Convert tab-separated values, such as a paste from Excel, into JSON · Query String Parser – Split a URL query string into a table of decoded parameters.
Also works as: JWKS to PEM.