FormatterHQ
JSON Tools XML Tools YAML Tools CSV & TSV Tools HTML Tools CSS Tools JavaScript Tools SQL Tools Code Formatters & Beautifiers Minifiers Validators Data Converters Data to Class Generators Escape & Unescape Encode & Decode Base64 Tools Hash & Cryptography String & Text Utilities Number Converters Color Converters Unit Converters IP & Network Tools Random Data Generators Diff & Compare Viewers & Editors Image Tools PDF Tools Markdown Tools SEO & Webmaster Tools Developer Utilities JSON Formatter PDF Tools XML Formatter Beautifiers Converters Blog

PEM to JWK Converter

Paste an RSA, EC or Ed25519 key, or a certificate, in PEM format and get a JSON Web Key, or a complete JWKS ready to publish for token verification.

Input TEXT
Output JSON
Ready.

How to use the PEM to JWK Converter

  1. Paste one or more PEM blocks: PUBLIC KEY, PRIVATE KEY, RSA PRIVATE KEY, EC PRIVATE KEY or CERTIFICATE.
  2. Optionally set a Key ID (leave it blank to use the RFC 7638 thumbprint) and choose use: sig or enc.
  3. Tick Wrap in a JWKS to get a {"keys": […]} document, and Private key: output public part only to drop the secret fields.
  4. Click Convert to JWK and copy the JSON.

Convert PEM to JWK for JOSE and OAuth

JWT libraries, OAuth authorization servers and OpenID Connect clients describe keys as JSON Web Keys (JWK, RFC 7517), while OpenSSL and most key generators write PEM. This pem to jwk converter bridges the two. It reads RSA, EC (P-256, P-384, P-521) and Ed25519 keys and writes the matching JWK with the alg, kid and optional use members filled in.

Example

The sample P-256 public key, with use set to sig, converts to:

{
  "kty": "EC",
  "x": "JrocOMVB3s0sRD_b5ehRYgQ_NQNrPZSYWe-8QUcO6PY",
  "y": "SDzzniq7opG2bUyDdodckEjjhVbj-wDKbU4w_paSmGo",
  "crv": "P-256",
  "alg": "ES256",
  "use": "sig",
  "kid": "hKbvYSZiIpgeOaJMdd2IADeQHiU8ITjVvd2YwwpcZOg"
}

What gets converted

  • PUBLIC KEY (SPKI): becomes a public JWK.
  • CERTIFICATE: the public key is extracted, and the certificate itself is added as an x5c entry, which some identity providers expect in their JWKS.
  • PRIVATE KEY, RSA PRIVATE KEY and EC PRIVATE KEY: become private JWKs with d (and for RSA also p, q, dp, dq, qi), unless you tick the public-only option.

The alg is chosen from the key: RS256 for RSA, PS256 for RSA-PSS keys, ES256, ES384 or ES512 by curve, and EdDSA for Ed25519. Paste several blocks at once to convert them together, which is handy for building a JWKS during key rotation.

How the kid is calculated

When the Key ID field is blank, the kid is the RFC 7638 JWK thumbprint: a SHA-256 hash of the required public members in a fixed order. The same public key always gets the same kid, and the private and public forms of a key share it, so verifiers can match tokens to keys reliably.

Common errors and fixes

  • "RSA PUBLIC KEY is not supported": convert PKCS#1 public keys to SPKI with openssl rsa -RSAPublicKey_in -pubout and paste the result.
  • "Encrypted private keys are not supported": decrypt the key with openssl first.
  • "Unsupported EC curve": only the NIST curves P-256, P-384 and P-521 have JWS algorithms here. secp256k1 keys are rejected.

Going the other direction? Use the JWK to PEM converter. To test the JWK, sign a token with the JWT encoder and check it with the JWT verifier.

Privacy

Conversion uses the jose library and WebCrypto in your browser. Private keys are not uploaded, but they do appear in the output box, so clear it when you are done.

Frequently asked questions

How do I create a JWKS from my public key?
Paste the PEM public key, tick Wrap in a JWKS and set use to sig. The output is a {"keys": [...]} document you can serve at your jwks_uri. For key rotation, paste the old and new public keys together.
Should I publish the private JWK?
Never. Only public JWKs belong in a JWKS. If you converted a private key, tick the public-only option before copying anything you intend to publish.
Why is the kid a long random-looking string?
It is the Base64URL SHA-256 thumbprint defined in RFC 7638, derived from the public key. You can type your own Key ID instead, but the thumbprint has the advantage of being reproducible.
Can I convert an X.509 certificate to a JWK?
Yes. The public key from the certificate becomes the JWK, and the certificate is included as a Base64 DER value in the x5c array. The certificate's validity dates are not checked.

Last updated October 3, 2026

Related tools

JWK to PEM Converter Convert JSON Web Keys or a whole JWKS (RSA, EC, OKP) into PEM public (SPKI) and private (PKCS#8) keys. DER to PEM Converter Convert binary DER (.der, .cer) certificates and keys, or their hex/Base64 dump, into PEM text with the right BEGIN/END header. PEM to DER Converter Convert PEM certificates, keys and CSRs to binary DER: view it as hex or Base64 or download the .der file. ROT13 Encoder / Decoder Encode or decode ROT13 text instantly. ROT13 shifts each letter 13 places, so the same operation hides and reveals spoilers. SAML Response Decoder Decode Base64 or deflated SAMLResponse and SAMLRequest messages into readable XML and summarise issuer, NameID, conditions and attributes. String to Byte Array Convert a string into its UTF-8 byte values as a decimal list, array or signed Java byte array. String to Hex Convert text to hexadecimal: each UTF-8 byte of the string is written as two hex digits. Text to ASCII Codes Convert each character of your text to its ASCII / Unicode code in decimal, hex, octal, binary or HTML form. Text to Binary Convert text to binary code: every UTF-8 byte becomes a group of eight 0s and 1s. Text to HTML Entities Convert plain text, symbols and accented letters into named HTML entities like © and ♥. Unicode Character Inspector Inspect every character in a string: code point, category, script, UTF-8/UTF-16 bytes, HTML entity and JavaScript/CSS escapes. URL Decode Decode percent-encoded URLs and query strings back into readable text, with full UTF-8 support.