# JWK Converter

Convert keys between PEM and JSON Web Key. Paste a PEM private key in PKCS #8, PKCS #1 or SEC1 form, a public key or a certificate to get its JWK, or paste a JWK or a JWKS with up to 20 keys to get PKCS #8 and SPKI PEM back. RSA, EC (P-256, P-384, P-521, secp256k1), Ed25519, Ed448, X25519 and X448 keys are supported, each shown with its type and RFC 7638 thumbprint.

## Frequently asked questions

### How does the converter know which direction to convert?

Input that starts with { is read as a JWK or a JWKS and converted to PEM. Input that contains a -----BEGIN line is read as PEM and converted to JWK. Anything else is rejected with a hint about the expected formats.

### Which PEM inputs are accepted?

Unencrypted private keys in PKCS #8 (BEGIN PRIVATE KEY), PKCS #1 (BEGIN RSA PRIVATE KEY) and SEC1 (BEGIN EC PRIVATE KEY) form, public keys as SPKI (BEGIN PUBLIC KEY) or PKCS #1 (BEGIN RSA PUBLIC KEY), and X.509 certificates, whose public key is converted. When several PEM blocks are pasted, the first private key wins, otherwise the first public key or certificate.

### What do I get for a private key?

A private PEM key produces the private JWK with all its members, such as d, p, q, dp, dq and qi for RSA, plus the matching public JWK. Share only the public JWK, because the private one contains the secret key material.

### Can I convert a whole JWKS?

Yes. Paste a document with a keys array of up to 20 keys, for example from a jwks_uri endpoint, and every key is converted to PEM with its index and kid. Private JWKs, recognized by their d member, return both the PKCS #8 private key and the SPKI public key.

### Why can a symmetric key not be converted?

Keys with kty oct are plain secret bytes for HMAC or AES and have no PEM representation. Use them directly, for example in the JWT Generator, where an oct JWK is accepted as the HMAC secret.

### What does the kid option do?

When it is on, the RFC 7638 thumbprint of the key is added as the kid member of the generated JWK. This gives the key a stable identifier that verifiers can match against the kid header of a JWT.

### What is the RFC 7638 thumbprint?

It is a base64url SHA-256 hash over the required public members of the key in a fixed order, such as e, kty and n for RSA or crv, kty, x and y for EC. The same key always has the same thumbprint, whether it is stored as PEM or as JWK.

### Are encrypted keys or OpenSSH keys supported?

No. Encrypted PEM keys need their passphrase removed first, for example with openssl pkey -in encrypted.pem -out key.pem. OpenSSH private keys must be converted to PEM by ssh-keygen before they can be read here.

### Which key types work?

RSA, EC on P-256, P-384, P-521 and secp256k1, and the OKP types Ed25519, Ed448, X25519 and X448. DSA and Diffie-Hellman keys have no JWK form and are rejected with an explanation.

### Is my private key kept?

No. The key is converted in memory for this request and never logged or saved. Prefer converting public keys online and handle production private keys only on systems you control.

Your ad here?

[Email us](mailto:hi@dennn.is?subject=Advertising%20on%20OneClick%20Pro)

[Ad The agent-ready plugin suite for WordPress.](https://sleekwp.com/?ref=oneclickpro)