JWK to PEM Converter: Convert JSON Web Keys Online

JSON Web Keys (JWKs) have become the standard currency for cryptographic keys on the modern web. Identity providers publish them in JWKS endpoints, cloud KMS services export them as JSON, and JWT libraries consume them natively. Yet much of the infrastructure that actually uses keys — OpenSSL, nginx, Java keystores, and decades-old TLS stacks — still speaks PEM. Bridging these two worlds is a routine but error-prone chore for developers and DevOps engineers.

The JWK to PEM Converter removes that friction. This free, browser-based tool converts JSON Web Keys to PEM format and back, supporting RSA, EC (P-256, P-384, P-521), and Ed25519 keys. Because it runs entirely on the Web Crypto API built into your browser, your key material never touches a server.

In this guide, we'll explain why the converter is useful, how it works under the hood, and how to get the most out of it — including practical use cases and best practices for handling private key material safely.

Why Use the JWK to PEM Converter?

• Bidirectional conversion. Go from JWK to PEM when your server needs a classic key file, or from PEM to JWK when you need to publish keys in a JWKS document — all in one tool.
• 100% client-side processing. The converter runs entirely in your browser via the Web Crypto API. Key material is never uploaded, logged, or stored anywhere.
• Broad algorithm coverage. RSA keys, elliptic-curve keys on the NIST curves P-256, P-384, and P-521, and modern Ed25519 keys are all supported.
• Smart key detection. The tool reads the kty field to determine the key type and checks for the d parameter to distinguish private keys from public keys automatically.
• Correct PEM encoding. Public keys are exported as SPKI (BEGIN PUBLIC KEY) and private keys as PKCS#8 (BEGIN PRIVATE KEY), while legacy RSA PRIVATE KEY and EC PRIVATE KEY blocks are parsed on input.
• Developer-friendly output. Get pretty-printed JSON with canonical field ordering, one-click copy to clipboard, and clear error messages when required fields like kty or crv are missing.

Key Features

A few features deserve a closer look:

• Legacy header support. Many tools still emit PKCS#1 (RSA PRIVATE KEY) or SEC1 (EC PRIVATE KEY) blocks. The converter accepts these on input and normalizes them, so you don't have to guess which OpenSSL flag produced a file.
• Canonical JSON ordering. When converting PEM to JWK, the output follows the conventional field order, making diffs between key representations predictable.
• Actionable error messages. Instead of a generic failure, you get specific messages — for example, when a JWK is missing its kty or an EC key lacks a crv — so you know exactly what to fix.

How to Use

1. Open the tool. Visit the JWK to PEM Converter in any modern browser.
2. Paste your key. Drop a JWK JSON object into the input panel, or paste a PEM block including its BEGIN and END lines.
3. Let the tool detect the direction. The converter identifies whether you supplied JWK or PEM input, determines the key type, and detects whether it is a public or private key.
4. Convert. Click the convert button. The Web Crypto API imports the key and re-exports it in the target format.
5. Copy the result. Review the pretty-printed output and use copy-to-clipboard to drop it straight into your config file, JWKS document, or terminal.

Understanding JWK and PEM Formats

What Is a JWK?

A JSON Web Key, defined in RFC 7517, is a JSON object that represents a cryptographic key. Each field has a precise role:

• kty — the key type: RSA, EC, or OKP (octet key pair, used for Ed25519).
• n and e — the modulus and public exponent of an RSA key.
• crv — the curve for EC and OKP keys, such as P-256, P-384, P-521, or Ed25519.
• x and y — the public point coordinates on an elliptic curve.
• d — the private scalar. Its presence is what makes a JWK a private key; remove it and you have the corresponding public key.

JWKs rarely travel alone. Identity providers bundle multiple public keys into a JSON Web Key Set (JWKS), served at a well-known endpoint so relying parties can verify JWT signatures and rotate keys without downtime.

What Is PEM?

PEM (Privacy-Enhanced Mail) is the older format: a Base64-encoded DER binary wrapped between textual header and footer lines. The header tells you what is inside:

• BEGIN PUBLIC KEY — a SubjectPublicKeyInfo (SPKI) structure, the standard container for public keys.
• BEGIN PRIVATE KEY — a PKCS#8 structure, the modern container for private keys.
• BEGIN RSA PRIVATE KEY and BEGIN EC PRIVATE KEY — legacy PKCS#1 and SEC1 headers still emitted by older OpenSSL versions.

Why Do Both Formats Exist?

Each format dominates a different ecosystem. JWK is native to the JWT and OAuth world: it is easy to parse in JavaScript, embeds algorithm metadata, and fits naturally into HTTP APIs and JWKS endpoints. PEM predates the web by decades and remains the lingua franca of OpenSSL, nginx and Apache TLS configuration, certificate chains, and countless CLI tools. Converting between them is the glue between modern identity systems and classic infrastructure.

Practical Use Cases

Migrating Keys from a JWKS Endpoint to a PEM-Based Server

Suppose your identity provider publishes signing keys as a JWKS, but your API gateway or legacy service only accepts PEM files. Copy the relevant JWK, paste it into the converter, and get a clean PUBLIC KEY PEM block ready for your configuration.

Using JWK Keys with OpenSSL and nginx

OpenSSL commands and nginx ssl_certificate_key directives expect PEM. If your key management system hands you a JWK, convert it to PKCS#8 PEM and use it directly with OpenSSL, nginx, or any TLS-terminating proxy — no manual ASN.1 wrangling required.

Importing Keys from Cloud KMS Providers

Cloud KMS and secret-manager services often export keys as JWK JSON. Converting to PEM lets you feed those keys into local testing environments, CI pipelines, or tools that predate cloud-native key formats.

Debugging JWT Signing Issues

When a JWT fails signature verification, comparing the key the signer uses against the key the verifier trusts is the fastest diagnostic. Convert both representations to a common format and diff them — mismatched n values or curve coordinates become obvious immediately.

Best Practices

• Treat private keys as secrets. Any JWK containing a d parameter is a private key. Handle it with the same care as a password or API token.
• Never paste production keys into unknown online tools. Many web converters upload input to a server. Prefer tools that run 100% client-side, like this one, so key material never leaves your machine.
• Verify round-trip conversions. Convert JWK → PEM → JWK and confirm the fields match. A clean round trip catches encoding mistakes before they reach production.
• Validate key parameters. Confirm the curve, key size, and algorithm match your security policy before deploying a converted key.
• Rotate keys regularly. Use JWKS key IDs (kid) and rotation windows so a compromised key has a limited blast radius.
• Store converted keys securely. Write PEM files with restrictive permissions and keep them out of version control.

Convert Your Keys in Seconds

Whether you're wiring up an OAuth flow, debugging a JWT, or migrating keys between cloud and on-prem infrastructure, the JWK to PEM Converter handles RSA, EC, and Ed25519 keys instantly — right in your browser, with nothing uploaded anywhere. Open the tool, paste your key, and get a clean conversion in one click.

Related Tools You Might Like

• JWT Decoder — decode and inspect JSON Web Tokens.
• RSA Key Generator — generate fresh RSA key pairs for your projects.
• Certificate Generator — create self-signed certificates for testing.

Happy converting!