BYTETOOLS

PEM to JWK Converter

Convert a PEM public or private key to a JSON Web Key and compute its RFC 7638 thumbprint, all locally in your browser with Web Crypto.

What is the PEM to JWK Converter?

Converting PEM to JWK means Base64-decoding the SPKI or PKCS#8 body, importing it with the Web Crypto API and exporting it as JSON — giving you n and e for RSA keys, or crv, x and y for elliptic-curve keys.

  • SPKI public keys and PKCS#8 private keys converted to JWK
  • RSA plus ECDSA and ECDH on P-256, P-384 and P-521
  • Optional RFC 7638 thumbprint, Base64url-encoded with padding stripped
  • Clear guidance when a PKCS#1 or SEC1 key needs converting first
  • Formatted, copyable JWK JSON output
  • Entirely offline — the key never leaves your browser

How to use the PEM to JWK Converter

  1. 1

    Paste a PEM key — BEGIN PUBLIC KEY for SPKI or BEGIN PRIVATE KEY for PKCS#8.

  2. 2

    Choose the algorithm and curve that match the key you pasted; an EC key imported as RSA will always fail.

  3. 3

    Leave the thumbprint checkbox ticked if you want a stable kid value computed.

  4. 4

    Click Convert to JWK, or press Load sample PEM to try it.

  5. 5

    Copy the JWK JSON, and the thumbprint if you are populating a JWKS.

About the PEM to JWK Converter

JOSE libraries, OIDC discovery documents and JWKS endpoints all speak JSON Web Key, while your certificate tooling produces PEM. This converter imports a PEM public key in SPKI form or a private key in PKCS#8 form and exports the equivalent JWK, showing kty and n and e for RSA, or crv, x, y and d for elliptic curves.

It also computes the RFC 7638 thumbprint: a SHA-256 hash over the required JWK members only, serialised in lexicographic order with no whitespace, then Base64url-encoded. Because public and private forms of the same key produce the same thumbprint, it makes an excellent stable kid value for a JWKS.

The conversion uses your browser's Web Crypto engine and nothing is uploaded. If you paste a legacy PKCS#1 or SEC1 key the tool tells you which OpenSSL command converts it to PKCS#8 first, rather than failing with an unhelpful error.

Frequently asked questions

How do I convert a PEM public key to JWK format?

Paste the BEGIN PUBLIC KEY block, select the matching algorithm, and click Convert to JWK. You get the JSON object with kty, n and e for RSA keys, or crv, x and y for elliptic-curve keys, ready to drop into a JWKS.

What is a JWK thumbprint used for?

It is a stable, deterministic identifier for a key, computed only from the members that define the key itself. Because it ignores kid, alg and use, the same key always produces the same thumbprint — which makes it the natural choice for the kid value.

Why does my BEGIN RSA PRIVATE KEY file not work?

That is the legacy PKCS#1 format, and Web Crypto only imports PKCS#8. Convert it locally first with openssl pkcs8 -topk8 -nocrypt -in key.pem -out pkcs8.pem, then paste the result. The tool detects this case and shows you the command.

Can I convert a certificate to a JWK?

Not directly, because a certificate is a signed wrapper around a key rather than a key itself. Extract the public key first with openssl x509 -in cert.pem -pubkey -noout, then paste that PEM block here.

Do I need to pick the right algorithm?

Yes. Web Crypto validates the key against the algorithm you name, so an EC key imported as RSA is rejected outright. If conversion fails, the algorithm selector is the first thing to check.

Related tools