JWK to PEM Converter
Convert JSON Web Keys (JWK) to PEM format and back — using your browser's native Web Crypto API. Supports RSA and Elliptic Curve keys.
How ZeroData protects your privacy
- ✓ No Uploads: Tool input is processed in your browser and is not sent to ZeroData servers.
- ✓ No Storage: Tool input is not saved by this website.
- ✓ No Input Tracking: Analytics never receive the text, files, keys, or credentials you process.
- ✓ Verifiable: Disconnect from the network after the page loads; local tool processing continues without uploading your input.
Why Convert Between JWK and PEM?
Modern authentication and authorization systems frequently use two different formats for cryptographic keys. JWKS endpoints — used by OAuth 2.0 providers like Auth0, Okta, Google, and Azure AD — serve keys in JWK (JSON Web Key) format as defined in RFC 7517. However, most server-side libraries, reverse proxies, and API gateways expect keys in the traditional PEM format.
This mismatch means that developers regularly need to convert keys between formats. For example, when configuring Nginx or Apache to verify JWT signatures, you need the public key in PEM format — but the identity provider only exposes it as a JWK via its /.well-known/jwks.json endpoint.
How It Works
The conversion between JWK and PEM is fundamentally about transforming how cryptographic parameters are encoded. A JWK represents the mathematical components of a key (such as the modulus n and exponent e for RSA) directly as Base64URL-encoded strings within a JSON object. PEM format, conversely, takes these exact same mathematical components, encodes them using strict ASN.1 rules into a binary DER (Distinguished Encoding Rules) structure, and then wraps that binary data in Base64 with standard -----BEGIN----- and -----END----- header markers. This tool parses the components from one format, translates the structure perfectly, and serializes it into the other format without altering the underlying cryptographic mathematics. The process guarantees bit-for-bit fidelity of the core public and private parameters.
How the Web Crypto API Handles Key Conversion
This converter uses the browser's built-in Web Crypto API — the same cryptographic engine that powers HTTPS in your browser. The conversion flow is:
- JWK → PEM: Import the JWK using
crypto.subtle.importKey('jwk', ...), then export as SPKI (public) or PKCS#8 (private) usingcrypto.subtle.exportKey(). - PEM → JWK: Strip the PEM headers, decode the Base64 body to a binary buffer, import using
crypto.subtle.importKey('spki'/'pkcs8', ...), then export as JWK.
Because the Web Crypto API handles all cryptographic operations natively, no external JavaScript libraries are needed. This keeps the tool fast, secure, and dependency-free.
Supported Key Algorithms
The tool supports the most common key types used in JWT/OIDC ecosystems:
- RSA: RS256 (SHA-256), RS384 (SHA-384), RS512 (SHA-512) — used by most enterprise identity providers.
- Elliptic Curve: ES256 (P-256), ES384 (P-384), ES512 (P-521) — smaller keys with equivalent security, preferred for modern applications.
Browser Compatibility
Converting cryptographic keys locally requires the Web Crypto API, which is a mature web standard. This tool works flawlessly across all modern browsers including Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge. Because it leverages built-in native crypto engines rather than massive JavaScript bundles, you benefit from native execution speed and top-tier reliability across both desktop and mobile platforms. The native cryptographic execution layer ensures that complex Elliptic Curve point multiplication or RSA modulus calculations complete within milliseconds.
Why Privacy Matters
Cryptographic keys are the absolute foundation of your system's security. Private keys authorize access, sign identities, and decrypt confidential traffic. Exposing them to an online converter that transmits data back to a remote server is catastrophic for security. This tool is 100% private — data never leaves your browser. All parsing, encoding, and conversion happens exclusively in local browser memory. No network requests are made, ensuring your most sensitive security infrastructure remains completely secure.
Related Tools in the JWT / JWK Cluster
Need to generate fresh JWK key pairs? Use our JWK & JWKS Generator to create RSA and EC keys directly in your browser. To verify JWT token signatures against a public key, try the JWT Signature Verifier. For creating test tokens, check out our JWT Generator.
For quick inspection of token headers and payloads, the JWT Debugger decodes any JWT without sending it to a server, while the JWT Expiry Checker verifies its validity timestamp.
Want to learn more about how JWT signing algorithms, keys, and token lifetimes interact securely? Read our comprehensive JWT Security Complete Guide.
How to Use the JWK to PEM Converter
- Paste your JWK (or JWKS) into the input textarea, or click 'Load Example' for a demo key.
- Click 'Convert to PEM' to generate the PEM-encoded public and private keys.
- Copy the PEM output and use it in your server configuration, API gateway, or application code.
- To reverse the conversion, switch to 'PEM → JWK' mode and paste a PEM key.
- The tool auto-detects RSA vs EC key types and selects the correct algorithm.
- Verify the algorithmic curve type (e.g., P-256 vs P-384) implicitly defined within your JWK payload before conversion to ensure client compatibility.
- Use the generated PEM file to manually validate JSON Web Signature (JWS) payloads using command-line OpenSSL utilities.
Common Use Cases
- Converting JWKS endpoint keys to PEM format for local JWT signature verification in Node.js or Python.
- Extracting public keys from OAuth 2.0 / OpenID Connect discovery endpoints for API gateway configuration.
- Converting PEM certificates to JWK format for uploading to Auth0, Firebase, or Keycloak identity providers.
- Migrating cryptographic keys between systems that use different key formats (e.g., AWS Cognito to custom API).
- Debugging JWT signature verification failures by comparing JWK and PEM key representations.
- Translating Auth0 discovery endpoint JWKS responses into PEM strings to configure hardware security modules (HSMs).
- Normalizing legacy PKCS#1 RSA keys into standards-compliant JWK objects for modern OAuth 2.0 authorization servers.
Frequently Asked Questions
What is the difference between JWK and PEM format?
JWK (JSON Web Key) is a JSON-based format defined in RFC 7517 for representing cryptographic keys. PEM (Privacy-Enhanced Mail) is the older, widely-used Base64-encoded format wrapped in '-----BEGIN/END-----' markers. JWK is commonly used in OAuth 2.0, OpenID Connect, and JWKS endpoints, while PEM is the standard format for OpenSSL, SSH, and most server-side TLS configurations.
Which key types does this converter support?
This converter supports RSA keys (RS256, RS384, RS512) and Elliptic Curve keys (ES256/P-256, ES384/P-384, ES512/P-521). These cover the vast majority of keys used in JWT signing, OAuth 2.0, and OpenID Connect. All conversion happens via the browser's native Web Crypto API.
Is it safe to paste my private key here?
Yes. This tool runs 100% in your browser using the Web Crypto API. No keys, tokens, or data are transmitted to any server. You can verify this by opening your browser's Developer Tools Network tab — you will see zero outbound requests during conversion.
What PEM formats does this tool output?
For public keys, the tool exports SPKI (Subject Public Key Info) format wrapped as '-----BEGIN PUBLIC KEY-----'. For private keys, it exports PKCS#8 format wrapped as '-----BEGIN PRIVATE KEY-----'. These are the standard formats accepted by OpenSSL, Node.js crypto, Java KeyStore, and most TLS/SSL libraries.
Can I convert a JWKS (key set) with multiple keys?
Yes. If you paste a JWKS (a JSON object with a 'keys' array), the tool will automatically extract and convert the first key in the set. For multi-key JWKS, you can edit the input to select a specific key by its 'kid' (Key ID) property.
How does the converter handle the extraction of ECC coordinate points?
Elliptic Curve Cryptography relies on specific mathematical coordinates (the X and Y values) mapped on a finite field. The converter parses these Base64URL-encoded coordinates from the JWK, serializes them into an uncompressed binary point format, and wraps them in an ASN.1 SubjectPublicKeyInfo structure to generate a standards-compliant PEM file.
Why do some JWK properties like 'alg' or 'use' disappear in the PEM output?
The PEM format is strictly designed to transport bare cryptographic material (modulus, exponents, curve coordinates) and does not inherently support application-level metadata. Attributes like the intended algorithm (alg) or key usage (use) are specific to the JSON Web Key specification and are intentionally discarded when mapping the key into the raw ASN.1 structure.
Can I convert symmetric keys like HMAC secrets using this tool?
No, this tool specifically targets asymmetric public/private key pairs (RSA and EC). Symmetric keys in JWK format (kty: 'oct') represent raw byte arrays for algorithms like HS256. Converting them to PEM is generally invalid since PEM structures like PKCS#8 are designed for encapsulating asymmetric mathematical parameters.
Related Tools
JWT Debugger
Inspect JWT headers and payloads locally without leaking tokens to third-party tools.
JWT Generator
Create test JWT tokens with custom headers and payloads locally. Sign with HMAC-SHA256 using Web Crypto API.
JWT Expiry Checker
Paste a JWT and instantly see when it expires in your local timezone. No server, no uploads.
JWT Signature Verifier
Verify JWT signatures locally using Web Crypto API. Supports HS256, RS256, and ES256. Your secrets never leave your browser.
JWK & JWKS Generator
Generate JSON Web Keys (JWK) and JWKS for JWT signing. Supports RS256, RS384, RS512, ES256, ES384, ES512, HS256 — 100% browser-based via Web Crypto API.