About this tool
JSON Web Key (JWK) is the JSON representation of a cryptographic key used by JWT libraries, JWKS endpoints (/.well-known/jwks.json) and many web APIs. PEM is the older, Base64-wrapped text format most crypto tools, servers and certificate authorities still speak. This tool converts between the two entirely in your browser, using the same WebCrypto engine your browser already trusts for TLS.
Pick the direction, then the key type (RSA, or elliptic-curve P-256/P-384) and usage (signing vs. encryption) that matches the key you are converting — WebCrypto needs those to know how to interpret the bytes. Public keys convert to a JWK without a d field; private/key-pair PEMs (PKCS#8) produce a JWK with n/e/d (RSA) or x/y/d (EC). Only unencrypted PKCS#8 private keys and SPKI public keys are supported — older PKCS#1 (RSA PRIVATE KEY) or password-protected PEMs need converting to PKCS#8 first (e.g. with openssl pkcs8).
Frequently asked questions
What is a JWKS endpoint and why would I need this?
A JWKS (JSON Web Key Set) endpoint is a URL (often `/.well-known/jwks.json`) that publishes the public keys an authentication provider (like an OAuth/OIDC identity provider) uses to sign JWTs, in JWK format, so relying parties can fetch and use them to verify token signatures. If you're setting up your own token issuer, you'd convert your signing key's public half to JWK to publish there.
Why does my conversion fail with an import error?
The most common cause is a mismatched key-type or usage selector — e.g. selecting "EC P-256" for a key that's actually RSA, or "Encryption" for a key generated for signing. WebCrypto validates the algorithm against the actual key material strictly, so double-check the selectors match what the key was originally created for.