PEM to JWK Converter
Convert RSA or EC SPKI public keys between PEM and JWK with an RFC 7638 thumbprint
Handles RSA/EC public keys (SPKI PUBLIC KEY) only; private keys, certificates, and encrypted PEM are rejected.
The converted public key will appear here.
About this tool
PEM to JWK Converter translates RSA and P-256, P-384, or P-521 EC public keys between SubjectPublicKeyInfo PEM and public JWK fields. It removes private JWK members, exports a standard BEGIN PUBLIC KEY block, and computes the canonical RFC 7638 SHA-256 JWK thumbprint commonly used as a kid candidate. The converter intentionally rejects private-key, certificate, PKCS#1 RSA PUBLIC KEY, and encrypted PEM containers. A thumbprint identifies key material but does not establish trust, ownership, permitted use, or a certificate chain.
Scenario Recipes
Prepare a verification key for a JWKS
Goal: Convert an existing SPKI public key without exposing its private counterpart
- Paste the BEGIN PUBLIC KEY PEM and convert it to JWK.
- Confirm kty, curve or modulus size, then record the RFC 7638 thumbprint.
- Add policy-specific alg, use, and kid metadata only after checking the consuming service requirements.
Result: A public-only JWK and deterministic key identifier candidate ready for controlled integration.
Frequently Asked Questions
Which PEM block is supported?
The PEM input must be an unencrypted SubjectPublicKeyInfo block labeled BEGIN PUBLIC KEY.
Can it convert private keys?
No. Private parameters are never required or emitted; a JWK containing them is reduced to its public fields.
Which EC curves are supported?
Browser WebCrypto support is used for P-256, P-384, and P-521 public keys.
Why is RSA PUBLIC KEY rejected?
That label contains PKCS#1 rather than SPKI. Convert it to a standard PUBLIC KEY container in a trusted key-management workflow first.
What is the generated kid value?
It is an RFC 7638 SHA-256 JWK thumbprint and a deterministic candidate, not a mandatory identifier assigned by a server.
Is key material uploaded?
No. Import, export, public-field normalization, and thumbprint calculation use browser WebCrypto locally.
Keep browsing