FormatterHQ
JSON Tools XML Tools YAML Tools CSV & TSV Tools HTML Tools CSS Tools JavaScript Tools SQL Tools Code Formatters & Beautifiers Minifiers Validators Data Converters Data to Class Generators Escape & Unescape Encode & Decode Base64 Tools Hash & Cryptography String & Text Utilities Number Converters Color Converters Unit Converters IP & Network Tools Random Data Generators Diff & Compare Viewers & Editors Image Tools PDF Tools Markdown Tools SEO & Webmaster Tools Developer Utilities JSON Formatter PDF Tools XML Formatter Beautifiers Converters Blog

JWK to PEM Converter

Paste a single JWK, an array of keys or a full JWKS and get a PEM public key for each entry, plus a PKCS#8 private key when the JWK contains private members.

Input JSON
Output TEXT
Ready.

How to use the JWK to PEM Converter

  1. Paste a JWK object, an array of JWKs or a JWKS such as {"keys": […]}.
  2. For private JWKs, choose For private JWKs output: Private and public PEM, Private key only, or Public key only.
  3. Click Convert to PEM.
  4. Copy each PEM block. A comment line above each one names the kid, key type and curve.

Convert JWK to PEM for OpenSSL and servers

Identity providers publish their signing keys as a JWKS, but many tools, including OpenSSL, nginx, API gateways and older JWT libraries, want PEM. This jwk to pem converter reads RSA, EC and Ed25519 (OKP) JSON Web Keys and writes standard PEM: BEGIN PUBLIC KEY (SPKI) for public keys and BEGIN PRIVATE KEY (PKCS#8) for private ones.

Example

The sample JWKS holds one P-256 key. Converting it gives:

# kid hKbvYSZiIpgeOaJMdd2IADeQHiU8ITjVvd2YwwpcZOg — EC P-256
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJrocOMVB3s0sRD/b5ehRYgQ/NQNr
PZSYWe+8QUcO6PZIPPOeKruikbZtTIN2h1yQSOOFVuP7AMptTjD+lpKYag==
-----END PUBLIC KEY-----

When a JWKS contains several keys, each one gets its own comment line and PEM block, so you can find the key that matches a token's kid header.

Supported keys

  • RSA (kty: "RSA"): needs n and e, plus d, p, q, dp, dq and qi for a private key.
  • EC (kty: "EC"): curves P-256, P-384 and P-521 with x, y and optionally d.
  • OKP (kty: "OKP"): Ed25519 keys with x and optionally d.

If a key has no alg, one is inferred from its type and curve. Members such as use, kid and key_ops do not affect the PEM output.

Output options for private keys

A JWK containing d is private. By default you get both the PKCS#8 private key and the derived public key. Choose Public key only to extract a shareable public key from a private JWK, or Private key only to get just the PKCS#8 block. Public JWKs always produce a public PEM.

Common errors and fixes

  • "Symmetric oct keys have no PEM form": an HMAC key is just bytes. The secret is the Base64URL value in k, so decode it with a Base64 tool instead.
  • "Each key needs a kty member": you pasted something other than a JWK, such as an OpenID configuration document. Open its jwks_uri and paste that JSON instead.
  • "Input must be a JWK or JWKS JSON object": the JSON is invalid. Check for trailing commas or a truncated copy.

For the reverse conversion use PEM to JWK. To verify a token directly against a JWKS without converting, paste it into the JWT verifier.

Privacy

Keys are converted with the jose library in your browser and are never uploaded.

Frequently asked questions

How do I get a PEM public key from an OpenID Connect provider?
Open the provider's /.well-known/openid-configuration, follow the jwks_uri link, and paste the JSON here. Each key in the set is converted to a PEM public key labeled with its kid.
Why does the output use BEGIN PUBLIC KEY and not BEGIN RSA PUBLIC KEY?
The converter writes SPKI for public keys and PKCS#8 for private keys, because these formats work for every key type and are what modern libraries expect. If you need PKCS#1, convert with openssl rsa -pubin -RSAPublicKey_out.
Can I convert every key in a JWKS at once?
Yes. Paste the whole JWKS and each key is converted in order, with its kid in the comment line above the PEM block. Symmetric oct keys in the set stop the conversion with an error, so remove them first.
Does the tool keep the kid in the PEM?
PEM has no field for a key ID, so the kid is shown in a comment line above each block. Keep track of it yourself if you store the PEM files.

Last updated September 26, 2026

Related tools

PEM to JWK Converter Convert PEM public keys, private keys and certificates (RSA, EC, Ed25519) to JSON Web Keys or a JWKS with a thumbprint kid. DER to PEM Converter Convert binary DER (.der, .cer) certificates and keys, or their hex/Base64 dump, into PEM text with the right BEGIN/END header. PEM to DER Converter Convert PEM certificates, keys and CSRs to binary DER: view it as hex or Base64 or download the .der file. Morse Code Translator Translate text to Morse code and Morse code back to text in two linked boxes, one for each direction. ROT13 Encoder / Decoder Encode or decode ROT13 text instantly. ROT13 shifts each letter 13 places, so the same operation hides and reveals spoilers. SAML Response Decoder Decode Base64 or deflated SAMLResponse and SAMLRequest messages into readable XML and summarise issuer, NameID, conditions and attributes. String to Byte Array Convert a string into its UTF-8 byte values as a decimal list, array or signed Java byte array. String to Hex Convert text to hexadecimal: each UTF-8 byte of the string is written as two hex digits. Text to ASCII Codes Convert each character of your text to its ASCII / Unicode code in decimal, hex, octal, binary or HTML form. Text to Binary Convert text to binary code: every UTF-8 byte becomes a group of eight 0s and 1s. Text to HTML Entities Convert plain text, symbols and accented letters into named HTML entities like © and ♥. Unicode Character Inspector Inspect every character in a string: code point, category, script, UTF-8/UTF-16 bytes, HTML entity and JavaScript/CSS escapes.