What is PEM to JWK Converter?
PEM (Privacy-Enhanced Mail) is the most common format for storing cryptographic keys, using Base64-encoded DER with header/footer lines like -----BEGIN RSA PRIVATE KEY-----. JWK (JSON Web Key) is a JSON-based representation defined in RFC 7517, widely used in JWT (JSON Web Tokens), OAuth 2.0, OpenID Connect, and JWKS (JSON Web Key Set) endpoints that services like Auth0, Firebase, and AWS Cognito use to publish their public keys. This tool converts between the two formats using the Web Crypto API built into modern browsers, supporting RSA and EC keys in both public and private forms. It automatically detects key types, validates format, and suggests algorithm and usage fields for JWK output.
How to Use
- Choose the conversion direction using the toggle button (PEM to JWK or JWK to PEM).
- Paste your PEM key or JWK JSON in the input area.
- Click 'Convert' to generate the output — the tool validates your input and shows any errors.
- Review the validation messages (key type detected, any warnings).
- Copy the result and use it in your application — JWKS endpoint, JWT library, or server configuration.
Why Use This Tool?
Tips & Best Practices
- PEM headers like -----BEGIN RSA PRIVATE KEY----- indicate PKCS#1 format, while -----BEGIN PRIVATE KEY----- is PKCS#8 — the converter handles both automatically.
- JWK requires at minimum the 'kty' field. RSA keys need 'n' and 'e'; EC keys need 'crv', 'x', and 'y'. Missing required fields will produce validation errors.
- The tool automatically adds 'alg' and 'use' fields to JWK output when they can be inferred from the key type and curve.
- For maximum security, consider using this tool in an offline environment when converting private keys — close network connections before pasting sensitive key material.
Frequently Asked Questions
What key types are supported?
The converter supports RSA keys (PKCS#1 and SPKI/PKCS#8) and EC keys (SEC 1 and SPKI). Both public and private keys can be converted in either direction. Supported curves for EC keys include P-256, P-384, and P-521.
When should I NOT use this converter?
Do not use this converter when: you are converting keys on a shared or public computer (private key exposure risk); you need to convert keys for algorithms not supported by the Web Crypto API (Ed25519, DSA); you need to convert certificate chains (this tool handles individual keys only); or you need to convert PKCS#12 (.p12/.pfx) files (extract the PEM key first using OpenSSL).
How does the conversion work?
The tool uses the Web Crypto API built into modern browsers. For PEM to JWK, it imports the PEM key using crypto.subtle.importKey and exports it as JWK using crypto.subtle.exportKey. For JWK to PEM, the process is reversed. No data is sent to any server.
Is my private key safe?
Yes. All processing happens entirely in your browser using the Web Crypto API. Your keys are never sent to any server, stored, or transmitted. You can safely convert keys containing sensitive material. For maximum security, consider using this tool offline.
What is the difference between PEM and JWK?
PEM (Privacy-Enhanced Mail) is a Base64-encoded DER format wrapped in header/footer lines like -----BEGIN RSA PRIVATE KEY-----. JWK (JSON Web Key) is a JSON representation of a cryptographic key defined in RFC 7517. JWKs are commonly used in JWT, OAuth 2.0, and OpenID Connect because they are easy to transmit in JSON APIs and publish in JWKS endpoints.
What algorithms are supported for the 'alg' field?
For RSA keys, the tool suggests RS256 for signing and RSA-OAEP for encryption. For EC keys, it suggests ES256 (P-256), ES384 (P-384), or ES512 (P-521) depending on the curve. You can override the algorithm in the output JWK to match your application's requirements.
Real-world Examples
Converting a PEM public key to JWK for a JWKS endpoint
Many OAuth 2.0 and OpenID Connect providers require public keys in JWK format at a .well-known/jwks.json endpoint. Convert your PEM public key to JWK to publish it.
-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Z3VS5JJcds3xfn/ygKB ... wIDAQAB -----END PUBLIC KEY-----
{
"kty": "RSA",
"e": "AQAB",
"alg": "RS256",
"use": "sig",
"n": "0Z3VS5JJcds3xfn_ygKBm3JQ..."
}Converting a JWK to PEM for Nginx SSL configuration
Nginx and Apache require keys in PEM format. Convert a JWK received from your identity provider to PEM for server configuration.
{
"kty": "RSA",
"e": "AQAB",
"n": "0Z3VS5JJcds3xfn_ygKB..."
}-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Z3VS5JJcds3xfn/ygKB ... -----END PUBLIC KEY-----