JWK to PEM Converter Online

By Anish Nath - Security Engineer & Cryptography Expert | @anish2good | Last Updated: January 23, 2025 | 4.6/5 (756 reviews)
Privacy-First No Data Stored 100% Free
Conversion Configuration

Convert between JWK and PEM formats

Convert JSON Web Key to PEM format (RSA and Elliptic Curve keys supported)
Convert PEM format to JSON Web Key (RSA keys only)
Paste your JWK (JSON format) or PEM key here
Conversion Result

Your converted keys will appear here

Select conversion type, paste your key, and click "Convert"

Support This Free Tool

Every coffee helps keep the servers running. Every book sale funds the next tool I'm dreaming up. You're not just supporting a site — you're helping me build what developers actually need.

500K+ users
200+ tools
100% private
☕ One-time support Buy me a coffee 📚 Learn & support 9-Book Bundle - $9 Stay updated Follow @anish2good
Privacy Guarantee: Private keys you enter or generate are never stored on our servers. All tools are served over HTTPS.

Understanding JSON Web Keys (JWK)

A JSON Web Key (JWK) is a JSON data structure that represents a cryptographic key, as defined in RFC 7517. JWK format provides a standardized way to represent cryptographic keys in JSON, making them easy to exchange between systems, particularly in modern web applications, APIs, and security protocols like JWT, OAuth 2.0, and OpenID Connect.

Key Benefits:
  • Standardized Format: Industry-standard JSON structure for key representation
  • Easy Integration: Native JSON format works seamlessly with web APIs and JavaScript
  • Self-Describing: Key metadata (algorithm, usage, etc.) is embedded in the key itself
  • Flexible: Supports multiple key types: RSA, Elliptic Curve (EC), Octet Key Pair (OKP), and Octet Sequence

JWK Examples by Key Type

Elliptic Curve (EC) JWK Example 
{
  "kty": "EC",
  "crv": "P-256",
  "x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
  "y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
  "kid": "my-ec-key-2025",
  "use": "sig",
  "alg": "ES256"
}
EC Key Details: Elliptic Curve keys are efficient and secure. P-256 (secp256r1) provides 128-bit security, equivalent to RSA 3072-bit. Supported curves: P-256, P-384, P-521. Commonly used in modern applications for JWT signing and OAuth 2.0.
RSA JWK Example (Public Key) 
{
  "kty": "RSA",
  "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmb...",
  "e": "AQAB",
  "kid": "my-rsa-key-2025",
  "use": "sig",
  "alg": "RS256"
}
RSA Key Details: RSA keys are widely supported and used for both encryption and signing. Recommended sizes: 2048-bit (minimum), 4096-bit (recommended for long-term security). The n parameter is the modulus, e is the public exponent (typically 65537).
Octet Key Pair (OKP) - Ed25519 Example 
{
  "kty": "OKP",
  "crv": "Ed25519",
  "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
  "kid": "my-ed25519-key-2025",
  "use": "sig",
  "alg": "EdDSA"
}
OKP Key Details: Octet Key Pairs represent Edwards curve keys (Ed25519/Ed448). Ed25519 provides excellent security (128-bit) with small key sizes (256 bits) and fast operations. Used in modern JWT implementations and SSH keys. Ed448 provides 224-bit security.
Octet Sequence (HMAC/AES) Example 
{
  "kty": "oct",
  "k": "AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow",
  "kid": "my-hmac-key-2025",
  "use": "sig",
  "alg": "HS256"
}
Security Warning: Octet sequence keys are symmetric keys used for HMAC (HS256, HS384, HS512) and AES encryption. Keep these keys secret! They are used for both signing and verification, unlike asymmetric keys.

JWK Key Types Comparison

Key Type kty Value Use Cases Security Level Key Size Recommendation
Elliptic Curve EC JWT signing, OAuth 2.0, modern APIs 128-256 bit 256-521 bits Highly Recommended Best for new projects
RSA RSA JWT signing, encryption, legacy systems 112-140 bit 2048-4096 bits Recommended Widely compatible
Octet Key Pair OKP Ed25519/Ed448 signatures, modern JWT 128-224 bit 256-456 bits Excellent Modern alternative to EC
Octet Sequence oct HMAC signatures, AES encryption 128-256 bit 128-512 bits Symmetric Keep secret!

RSA JWK Field Reference

RSA keys in JWK format contain the following fields (all Base64URL encoded):

Public Key Fields
  • kty - Key type (always "RSA" for RSA keys)
  • n - Modulus (the public key component)
  • e - Public exponent (typically "AQAB" = 65537)
  • kid - Key ID (optional, for key identification)
  • use - Key use (optional: "sig" for signing, "enc" for encryption)
  • alg - Algorithm (optional: "RS256", "RS384", "RS512")
Private Key Fields
  • d - Private exponent (secret)
  • p - First prime factor (secret)
  • q - Second prime factor (secret)
  • dp - First factor CRT exponent: d mod (p-1)
  • dq - Second factor CRT exponent: d mod (q-1)
  • qi - First CRT coefficient: q^-1 mod p
Security Note: Private key fields (d, p, q, dp, dq, qi) must be kept secret and never shared.

Common JWK Use Cases

JWT (JSON Web Tokens)

JWK is used to represent the public keys for verifying JWT signatures. JWK Sets (JWKS) are commonly exposed at endpoints like /.well-known/jwks.json for token verification.

OAuth 2.0 / OpenID Connect

OAuth 2.0 providers use JWK Sets to publish their public keys, allowing clients to verify ID tokens and access tokens without pre-sharing keys.

API Authentication

APIs can use JWK for key-based authentication, allowing clients to register public keys and sign requests with corresponding private keys.

Key Exchange

JWK format simplifies key exchange between systems, making it easy to share public keys via JSON APIs, configuration files, or key management systems.

About This Tool & Author

Expert-Maintained Cryptography Tool

This JWK to PEM converter is developed and maintained by Anish Nath ( @anish2good), a Security Engineer and Cryptography Expert with extensive experience in network security and cryptographic implementations. The tool has been serving the developer and DevOps community since 2018, with over 756 verified reviews averaging 4.6/5 stars.

Security & Privacy Commitment

  • No Data Collection: Your keys are processed securely and are not stored on our servers. Nothing is logged or retained.
  • Industry Standards: Uses proven cryptographic libraries implementing RFC 7517 (JWK) and OpenSSL standards.
  • Regular Updates: Tool is actively maintained with security best practices and format support updated regularly.
  • Open Source Standards: Compatible with JWT, OAuth 2.0, OpenSSL, and all major cryptographic implementations.

Version History

  • v2.0 (Jan 2025): Enhanced UX, improved JSON response handling, added EEAT signals
  • v1.5 (2020): Added EC key support for JWK to PEM conversion
  • v1.0 (2018): Initial release with RSA support
Official Resources

Learn more about JWK and cryptographic key formats:

Community

Over 500,000 developers use 8gwifi.org tools monthly

Follow @anish2good on X

Trust Signals
  • 7+ years of service
  • 756 verified reviews
  • Active maintenance
  • Privacy-first approach
Quick Access