PEM to JWK Converter
Convert a PEM public or private key into a JSON Web Key (JWK) in your browser using Web Crypto. Supports RSA and EC keys.
About the PEM to JWK Converter
This tool converts a PEM-encoded key into a JSON Web Key (JWK). Paste an RSA or elliptic-curve key in SPKI (public) or PKCS#8 (private) PEM format and the converter imports it with the Web Crypto API and exports the equivalent JWK — the format used by OAuth, OpenID Connect and JWKS endpoints.
JWK is how modern auth systems publish and consume keys, so converting from the PEM your tools generate is a common need when configuring identity providers, verifying JWTs, or building a JWKS.
The conversion uses the browser's native crypto and runs entirely on your machine — your key is never uploaded. Still, treat private keys with care and prefer test keys where possible.
How to Use the PEM to JWK Converter
- 1Paste your PEM key (public SPKI or private PKCS#8).
- 2Select the key type and algorithm if prompted.
- 3Convert to produce the JWK JSON.
- 4Copy the JWK or download it.
Frequently Asked Questions
What key formats are supported?
Public keys in SPKI PEM (-----BEGIN PUBLIC KEY-----) and private keys in PKCS#8 PEM (-----BEGIN PRIVATE KEY-----), for RSA and elliptic-curve (P-256/P-384/P-521) keys. Legacy PKCS#1 RSA PEM (-----BEGIN RSA PRIVATE KEY-----) isn't imported by Web Crypto directly; convert it to PKCS#8 first.
What is a JWK used for?
A JSON Web Key represents a cryptographic key as JSON. It's the format OAuth 2.0, OpenID Connect and JWT ecosystems use to publish signing keys at a JWKS (JSON Web Key Set) endpoint and to configure verification. Converting your PEM to JWK lets you plug it into those systems.
Is it safe to convert a private key here?
The conversion runs entirely in your browser with Web Crypto and uploads nothing. Even so, private keys are sensitive — prefer doing this with development or test keys, and avoid pasting production private keys into any web tool unless you fully trust the environment.
Does the JWK include the private key parts?
If you provide a private key, the JWK contains the private components (like d for RSA/EC) so it's a full private JWK — keep it secret. If you provide only a public key, the JWK contains just the public parts and is safe to share, for example in a JWKS.
Why does my key fail to import?
Common causes are pasting a PKCS#1 RSA key (convert to PKCS#8 first), an incomplete PEM block, or a mismatched algorithm selection. Ensure the full BEGIN/END block is present and matches the key type you selected.