OneTaskBy Tim King · Updated
PEM to JWK Converter
RSA, EC and Ed25519 Keys Between PEM and JWK, With RFC 7638 Thumbprints
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the PEM to JWK Converter works
This PEM to JWK converter turns a PEM key into a JSON Web Key, or a JWK back into PEM. Paste either and the direction is detected for you. It handles RSA, P-256, P-384, P-521, Ed25519 and X25519 keys, public or private, and everything happens in your browser.
What the PEM to JWK converter accepts
PEM input can be PUBLIC KEY or PRIVATE KEY, and also the older RSA PUBLIC KEY, RSA PRIVATE KEY
and EC PRIVATE KEY forms that OpenSSL writes by default. JWK input can be a single key or a JWKS
document with a keys array, in which case the first key is converted. Output PEM is always SPKI for
public keys and PKCS#8 for private keys, which every modern library reads.
Key use and thumbprints
A JWK records the algorithm a key is for. Web Crypto needs to know that when it imports an RSA key, so
pick Encryption if the key is used for RSA-OAEP; the key material is the same either way. Each
conversion shows the RFC 7638 thumbprint, the value commonly used as a kid, so you can match keys
against a JWKS endpoint.
FAQ
Can it convert encrypted private keys?
No. Keys beginning BEGIN ENCRYPTED PRIVATE KEY, or with a Proc-Type: 4,ENCRYPTED header, need the
passphrase first. Decrypt them locally with openssl pkey -in key.pem -out plain.pem, convert the result,
and delete the plain copy when you are done.
Why is my certificate rejected?
A certificate is not a key; it contains a public key along with a signed identity. Use the PEM inspector
to look inside it, or extract the key with openssl x509 -in cert.pem -pubkey -noout and paste that
here instead.
Is it safe to paste a private key?
The conversion runs entirely in your browser and nothing is sent. Even so, pasting production private keys into any web page is a habit worth avoiding; for those, prefer a local tool such as OpenSSL or your language's crypto library.
See also: all Data & Code tools, Units, Images, Audio & Video, Documents.
Related tools
PEM Inspector
Decode PEM and DER into a readable ASN.1 tree.
RSA Key Generator
RSA key pairs as PEM or JWK, made in your browser.
EC Key Generator
Elliptic curve and Ed25519 key pairs as PEM or JWK.
JWT Decoder
Decode a JWT and read its claims and expiry.
CSR Decoder
Decode a CSR, verify its signature and spot problems before submitting.