JWK to PEM Converter
Convert a JSON Web Key or JWKS to a PEM public or private key, or a PEM key or certificate to a JWK and JWKS, with the RFC 7638 thumbprint as kid.
Free · No sign-up · Your inputs stay in your browser
Input
Convert between JWK and PEM
Output
Converting...
Converted by the browser's Web Crypto, so the key is parsed by the same code that would use it. The JWKS output keeps only the public members, even from a private key; never publish d, p or q. The thumbprint is the RFC 7638 SHA-256 of the key's required members, a stable kid that changes only when the key does.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Two formats, one key
OpenSSL, web servers and most libraries read PEM. JOSE libraries, OAuth servers and JWT verifiers read JWK, defined in RFC 7517. Identity providers publish their verification keys as a JWKS at a URL such as /.well-known/jwks.json, so converting is how you check a provider's key or publish your own.
Never publish private members
A private RSA JWK contains d, p, q, dp, dq and qi; a private EC or OKP key contains d. The JWKS output strips them, but check any JWKS you publish by hand for these fields.