Keys, Certificates & Tokens
JWK to PEM Converter
Convert RSA and P-256 EC JSON Web Keys, or a whole JWKS, to PEM. Public keys become SPKI blocks; keys with d become PKCS#8 blocks.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
RSA and supported EC key parameters determine the PEM key material. A private d member selects private output.
Public keys use SPKI; private keys use PKCS#8. A key set returns blocks in input order.
- Turn a key from a JWKS endpoint into PEM for OpenSSL or a JWT library.
Sources: RFC 7517: JSON Web Key structure; RFC 7518: parameters for RSA and EC keys
Convert a P-256 public key
Input: {"kty":"EC","crv":"P-256","x":"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4","y":"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM","use":"enc","kid":"1"}
Settings: No settings. The tool has only the Input field. The input is the public sample key from RFC 7517 Appendix A.1.
Result: -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMKBCTNIcKUSDii11ySs3526iDZ8A iTo7Tu6KPAqv7D7gS2XpJFbZiItSs3m9+9Ue6GnvHw/GW2ZZaVtszggXIw== -----END PUBLIC KEY-----
Check JWK fields and supported curves
- Paste a JWK, a JWK array, or a JWK Set.
- Include the parameters required by its kty.
- Inspect the PEM with openssl pkey before importing it elsewhere.
- EC support covers P-256 and secp256k1; P-384, P-521, OKP, and oct keys fail.
- The converter does not check whether an EC point lies on its named curve.
- Private output has no password protection.