Convert between JWK (JSON Web Key) and PEM formats for RSA and EC keys. Supports PKCS#8 and SPKI formats.
JWK and PEM describe key material at different layers. This converter reads an RSA or EC JWK, or a PEM block, and emits the same key material in the selected counterpart format: PKCS#8 for a private key or SubjectPublicKeyInfo (SPKI) for a public key. It translates JWK base64url parameters into the ASN.1 DER structures carried by PEM, and reverses that mapping for PEM input. A common surprise is that JWK annotations such as kid, use, alg, and key_ops have no standard field-to-field representation in SPKI or PKCS#8.
For RSA, n and e provide the public modulus and exponent. A full two-prime private JWK also carries d, p, q, dp, dq, and qi. For EC, crv identifies the curve, x and y give the public point, and d supplies the private value. The RSA integer members and EC coordinate and private-value members use unpadded base64url. Private output is impossible when only public parameters are present.
PEM is the textual envelope around base64-encoded DER. A BEGIN PUBLIC KEY block holds SubjectPublicKeyInfo, which contains an algorithm identifier and the public-key bit string. A BEGIN PRIVATE KEY block holds unencrypted PKCS#8 PrivateKeyInfo, which identifies the algorithm and wraps its private-key value. Conversion changes the container and textual encoding; it neither generates a new key pair nor recovers secret material from a public key.
No. An RSA or EC public JWK contains only the values needed for public-key operations. Select SPKI for that material. PKCS#8 private output requires secret parameters, such as an EC d value or RSA private integers. Those values are absent from a public JWK and cannot be reconstructed by changing its format.
SPKI and PKCS#8 encode cryptographic key structures, not the JOSE annotations attached to a JWK. A PEM block normally provides no kid, use, key_ops, or JOSE alg value to recover. Add those fields only from the surrounding application's configuration and policy; do not infer an alg merely from seeing an RSA or EC key.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.