All tools

JWK ↔ PEM Key Converter

Convert cryptographic public and private keys between JWK (JSON Web Key) format and PEM/X.509 format.

Crypto & Certs
Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Translate keys between JSON Web Key (JWK) and PEM / X.509 for Cognito, Auth0, Azure AD, and local backends. RSA, ECDSA, and oct secrets — computed entirely in this tab.

Why convert JWK ↔ PEM?

Cloud identity providers publish signing keys as JWKS (JSON Web Key Sets), while many local servers, OpenSSL workflows, and libraries expect PEM-encoded PKCS#8 / SPKI or X.509 certificates. Moving keys between Cognito, Auth0, Azure AD, and backend stacks usually means translating formats without corrupting key material.

This converter runs entirely in your browser with jose and WebCrypto so private keys never leave the tab. It also derives a SHA-256 JWK thumbprint (kid) when one is missing.

How to use this tool

  1. Open JWK → PEM, paste a public or private JWK, optionally set an algorithm hint, and convert.
  2. Or open PEM → JWK and paste PKCS#1, PKCS#8, SPKI, or X.509 PEM — or switch to symmetric secret → oct for HS* keys.
  3. Copy the result into JWT verify, OAuth private_key_jwt, or your IdP console.

Frequently asked questions

Are my private keys uploaded?

No. Conversion is 100% client-side. Key material stays in the browser DOM runtime and is not sent to stbox servers.

Which algorithms are supported?

RSA (RS256/384/512, PS256), ECDSA curves P-256/P-384/P-521 (ES256/384/512), and oct symmetric secrets as Base64 / Base64URL / Hex / UTF-8.

Can I convert PKCS#1 RSA PRIVATE KEY blocks?

Yes. PKCS#1 is normalized to PKCS#8 in-browser before import so jose/WebCrypto can process it.