b2KIT

JWK to PEM Converter

Convert between JSON Web Key (JWK) format and PEM-encoded public/private keys.

Tested tool guide Tested browser tools Checked August 16, 2026

What JWK to PEM Converter does and how it behaves

A JSON Web Key exposes a key as named JSON members, while PEM packages a binary key structure inside labeled Base64 text. This converter re-encodes the same public or private key between those representations. In the JWK-to-PEM direction, values such as an RSA modulus and exponent or elliptic-curve coordinates become fields in a PEM key container. In the reverse direction, the key fields become base64url JWK members. The frequent surprise is that `kid`, `use`, `key_ops`, and a JWS `alg` are JWK metadata, not intrinsic key material, so a PEM round trip cannot be assumed to preserve them.

How the result is produced

1

JWK into PEM

The `kty` member determines how key material is interpreted. For an RSA public key, `n` and `e` are base64url-encoded unsigned integers. For an EC public key, `crv`, `x`, and `y` identify the curve and point. Private JWKs add private parameters. Conversion places those values into a compatible binary key structure, then represents that structure as labeled PEM text.

2

PEM into JWK

A PEM block supplies a label and a standard-Base64 body. The label and enclosed key structure distinguish formats such as a generic public key, an RSA-specific key, or a private-key container. Converting to JWK extracts the mathematical key values and encodes each required byte string with base64url rules. This changes representation, not the key pair or its cryptographic strength.

Good uses

  • Copy one RSA or EC public key from a JWKS and convert it to PEM for a verifier or command-line utility that expects a PEM public-key block.
  • Represent an existing PEM public key as a JWK for configuration that requires JSON fields such as `kty`, `n`, and `e` or `crv`, `x`, and `y`.
  • Translate private-key material between a PEM-based signing application and a system that imports private JWK objects, while keeping the same underlying key pair.

Limits and checks

  • A JWKS is not one JWK. It wraps multiple JWK objects in a top-level `keys` array. When the input expects one key, select the intended object, commonly by its `kid`, rather than pasting the complete set.
  • Equivalent keys can have different PEM text because their containers, labels, line wrapping, or included private fields differ. A byte-for-byte text mismatch does not prove that the mathematical keys differ.
  • A private JWK exposes secret values directly in JSON. Conversion happens entirely in the browser and nothing is uploaded, but the resulting JSON or PEM is still unencrypted unless explicitly protected. Do not paste it into logs or share it as diagnostic text.

Common questions

Why did `kid` or `alg` disappear after a PEM round trip?

`kid` is an application-assigned identifier used to select among keys. `use`, `key_ops`, and `alg` likewise describe intended application behavior. Ordinary PEM key encodings carry key and algorithm structures, not those JWK properties. Save this metadata separately and restore it deliberately if the destination requires it.

Why does the RSA PEM have a different header than expected?

`BEGIN PUBLIC KEY` normally contains a SubjectPublicKeyInfo structure, while `BEGIN RSA PUBLIC KEY` contains a PKCS #1 RSA public-key structure. Both can describe the same modulus and exponent, yet their decoded bytes differ. Use the container required by the receiving system. Replacing only the header and footer does not transform the enclosed structure.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.