Turn a PEM public key, private key or certificate into a JSON Web Key or a JWK Set
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 16 Oct 2026.Publishing a jwks.json endpoint, or configuring an OAuth or OpenID Connect provider, needs keys as JSON Web Keys, while OpenSSL and most servers write PEM. Paste a PEM public key, a private key in PKCS#8, PKCS#1 or SEC1 form, or a certificate, and get the JWK with its RFC 7638 thumbprint as the kid. Tick As a JWK Set to wrap several keys in {"keys": [...]} ready to publish.
Paste the PEM block, or several, into the box.
Tick Public key only before publishing, so the private part is never in the output.
Tick Add kid and As a JWK Set, then copy the result into jwks.json.
JSON Web Keys and PEM files hold the same numbers in two wrappings. A JWK names each part, such as the modulus "n" and exponent "e" of an RSA key or the point "x" and "y" of an EC key, in Base64url. A PEM file holds the same values in DER, the binary format of X.509 and OpenSSL, inside BEGIN and END lines.
| Key | JWK to PEM | PEM to JWK |
|---|---|---|
| RSA public | SPKI or PKCS#1 | PUBLIC KEY, RSA PUBLIC KEY, certificate |
| RSA private | PKCS#8 or PKCS#1 | PRIVATE KEY, RSA PRIVATE KEY |
| EC P-256, P-384, P-521, secp256k1 | SPKI; PKCS#8 or SEC1 | PUBLIC KEY, PRIVATE KEY, EC PRIVATE KEY |
| Ed25519, Ed448, X25519, X448 | SPKI; PKCS#8 | PUBLIC KEY, PRIVATE KEY |
A JWK Set with several keys becomes several PEM blocks, and several PEM blocks become a JWK Set. Certificates and certificate requests give their public key.
The rest of the article, and all 6 questions about JWK to PEM Converter, are on the JWK to PEM Converter page.
Paste the JWK into the box and the PEM appears at once: a PUBLIC KEY block for a public key, a PRIVATE KEY block for a private one. For RSA keys you can switch to the older PKCS#1 form, and for EC private keys to SEC1. A JWK Set with several keys gives one PEM block for each key.
Open the jwks.json address of the provider in your browser, copy the whole JSON and paste it here. Each key in the keys list becomes a PEM public key, labelled with its type, size and thumbprint, so you can match it with the kid in the header of the token you want to verify.
A short identifier computed from the key itself, defined in RFC 7638: the required members, such as e, kty and n for RSA, are written as JSON in alphabetical order without spaces and hashed with SHA-256. The same key always gets the same thumbprint, so it works well as a kid.
A JWK for an Ed448 or X448 private key must include the public key, and OpenSSL usually writes these PEM files without it. Working it out needs Ed448 maths that browsers do not provide. Export the key with its public part, or convert the public key separately.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about JWK to PEM Converter and anybody who knows can answer. No account needed.
On the related tools: TSV to JSON – Convert tab-separated values, such as a paste from Excel, into JSON · Query String Parser – Split a URL query string into a table of decoded parameters.