JWK ↔ PEM Converter

Converts public and private keys between JWK, JWKS and PEM (SPKI for public keys, PKCS#8 for private keys). It detects the input format, shows the key type, curve or modulus size, kid, alg, use and key_ops, and calculates the RFC 7638 thumbprint. Use it to debug JWT signing keys, identity provider settings, API gateways and JWKS endpoints.

Key types: RSA, EC on P-256, P-384 and P-521, and Ed25519 where the browser supports it in Web Crypto. Input: a single JWK, a JWKS, or PEM blocks labelled PUBLIC KEY, PRIVATE KEY, RSA PUBLIC KEY and RSA PRIVATE KEY (PKCS#1), EC PRIVATE KEY (SEC1) or CERTIFICATE (its public key only). PKCS#1 and SEC1 keys are wrapped into SPKI or PKCS#8 before import. Encrypted private keys, RSA-PSS or RSA-OAEP restricted keys, X25519, secp256k1 and symmetric oct keys are reported as unsupported.

Parsing and conversion run in your browser with the Web Crypto API; the key is not sent to a CodingTool server. Private keys are never saved, and private output is masked on screen until you choose Reveal. Copy and Download always use the full key. Only display preferences such as Pretty JSON are remembered.

The thumbprint is the base64url SHA-256 hash of the required public members of the key, as defined in RFC 7638, so the public and private halves of a key pair share it. Turn on Thumbprint as kid to use it as a stable key ID. Otherwise kid, alg, use and key_ops are kept from the input JWK and can be edited under Key metadata.

Input is limited to 256 KB and 100 keys. PEM keys carry no kid, alg or use, so a PEM round trip drops them. Web Crypto validates the key material, so inconsistent parameters are rejected instead of being converted. Certificates are not validated: use the X.509 Certificate Inspector to check subject, validity and chains.