BYTETOOLS

JWK to PEM Converter

Convert a JSON Web Key to PEM using Web Crypto. Public keys export as SPKI and private keys as PKCS#8, ready for OpenSSL, Node.js, Go or Java.

What is the JWK to PEM Converter?

Converting a JWK to PEM means importing the JSON key into the Web Crypto API and re-exporting it in the SPKI container for public keys or PKCS#8 for private keys, then Base64-encoding it inside PEM armour.

  • RSA and elliptic-curve keys converted with the Web Crypto API
  • Public keys as SPKI, private keys as PKCS#8, both correctly armoured
  • Support for RSASSA-PKCS1-v1.5, RSA-PSS, RSA-OAEP and ECDSA on P-256, P-384 and P-521
  • Names the exact JWK members that are missing instead of failing with a generic error
  • One-click copy and .pem download
  • No uploads and no network requests — conversion is local to your browser

How to use the JWK to PEM Converter

  1. 1

    Paste a single JWK object — not a whole JWK Set — into the input box.

  2. 2

    For an RSA key, choose the algorithm and hash it will be used with; elliptic-curve keys use their own curve automatically.

  3. 3

    Click Convert to PEM, or press Load sample JWK to try it with the example key from RFC 7638.

  4. 4

    Check the tiles to confirm the key type and whether you produced a public or private key.

  5. 5

    Copy the PEM block or download it as a .pem file.

About the JWK to PEM Converter

JSON Web Keys are what OIDC providers publish and what JOSE libraries consume, but almost everything else — OpenSSL, nginx, Java keystores, Go's crypto packages — expects PEM. This converter bridges the two using your browser's own Web Crypto engine, so the conversion is done by the same audited code that handles TLS.

It handles RSA keys for RSASSA-PKCS1-v1.5, RSA-PSS and RSA-OAEP, and elliptic-curve keys on P-256, P-384 and P-521. Public keys come out as SPKI in a PUBLIC KEY block; private keys come out as PKCS#8 in a PRIVATE KEY block. If required JWK members are missing the tool names them rather than failing silently.

Everything happens in this tab. The key is never uploaded, logged or stored, and nothing survives closing the page — so download or copy the result before you navigate away. Converting a private key is inherently sensitive, so do it on a machine you trust.

Frequently asked questions

How do I convert a JWK to a PEM file?

Paste the JWK object above, pick the algorithm if it is an RSA key, and click Convert to PEM. You get a standard PEM block that OpenSSL, Node.js and Java all read directly, with a download button for the .pem file.

What is the difference between SPKI and PKCS#8?

SPKI is the container for public keys and produces a BEGIN PUBLIC KEY block. PKCS#8 is the modern container for private keys and produces BEGIN PRIVATE KEY. This tool picks the right one automatically based on whether the JWK has a d member.

Why does my RSA private JWK fail to convert?

Web Crypto needs the full Chinese Remainder Theorem parameter set to import an RSA private key, so p, q, dp, dq and qi must all be present alongside n, e and d. The tool lists exactly which ones are missing.

Can I convert an Ed25519 JWK to PEM here?

Not currently. Ed25519 keys use kty OKP, which most browsers still do not support in Web Crypto's importKey. Use openssl pkey on your own machine for those, or a server-side JOSE library.

Is it safe to convert a private key in a browser?

The maths runs in your browser's Web Crypto engine and nothing is transmitted, so the conversion itself is safe. The real question is the device: do this on a machine you control and trust, and treat anything converted on a shared computer as compromised.

Related tools