JWK and PEM Converter

Convert public keys between JWK and PEM in your browser, with the conversions that are not possible named rather than silently skipped.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

JWK or PEM The direction is detected from what you paste. Converted in your browser.

Two encodings of the same thing

A JWK and a PEM public key hold identical mathematics in different wrappers. JWK is JSON with base64url numbers, and it is what the JOSE and OpenID Connect world speaks. PEM is base64-wrapped DER following a structure called SubjectPublicKeyInfo, and it is what OpenSSL, web servers and almost every non-JavaScript library expect. Neither is better; they just live in different ecosystems, and the conversion is needed whenever those meet.

What cannot be converted, and why

Every format converter is tempted to quietly drop what it cannot carry. For key material that is how people end up shipping something subtly wrong, so each impossible case here gets a sentence instead of an empty output box:

Symmetric keys (oct) have no PEM form at all. PEM carries structured public-key formats; a raw secret has no structure. Base64 or hex is what you actually want.
Ed25519 and X25519 (OKP) are valid keys that Web Crypto does not support in most browsers. Converting them would mean shipping an elliptic-curve implementation to every visitor, which is a poor trade against one line of openssl pkey.
Curves outside P-256, P-384 and P-521 - secp256k1, for instance - for the same reason.
PKCS#1 and SEC1 private keys (BEGIN RSA PRIVATE KEY, BEGIN EC PRIVATE KEY) are the traditional OpenSSL formats, and Web Crypto reads only PKCS#8. The page gives you the exact command to convert first.
Encrypted private keys, because this page will not ask you for a passphrase.
Certificates, which are a public key wrapped in an identity and a signature - related, but not the same object.

On private keys

The conversion works for private keys and runs entirely in your browser - but the page says so loudly when it detects one, and that warning is not a formality. Pasting private key material into any web page is a habit worth not forming, because the next page you do it on may not be this one. For anything that matters, openssl pkey does the same job with no browser involved.

The output is clean

Web Crypto stamps key_ops, ext and sometimes alg onto keys it exports. Those are artefacts of the conversion rather than part of the key, and leaving them in produces a JWK that differs from the issuer's for no reason - so they are stripped. What comes out is the key and nothing else.

Frequently asked questions

Which PEM format does it produce?

SubjectPublicKeyInfo (BEGIN PUBLIC KEY) for public keys, and PKCS#8 (BEGIN PRIVATE KEY) for private ones. Those are the modern forms that almost everything accepts.

Can I convert a certificate to a JWK?

Not directly - a certificate contains a public key along with an identity and a signature over both. Extract the public key first, then convert that.

How do I know the conversion was faithful?

Convert back and compare, or compare thumbprints in the JWK and JWKS Viewer. A thumbprint is computed from the key's mathematical members only, so it is identical across encodings - that is what makes it a useful check.

Why does my RSA key come back without an alg?

Because a PEM does not record one. alg states an intended use, which is JOSE metadata rather than part of the key, so it cannot be recovered from PEM and is not invented.

Is my key uploaded?

No. Both directions use Web Crypto in your browser, and the downloads are generated there.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.