{{ summaryPlainText }}
Conversion stays in this browser. Source key material is never added to the shareable URL.
{{ inputFeedback }}
The PEM, checks, fingerprints, and exports all follow the selected key.
Auto resolves to SPKI for public-only material and PKCS#8 when private material is present. Choose SPKI for the narrower public handoff.
Use 48-76 characters only when a receiving importer requires a particular wrap.
characters
The 16-character default keeps tables compact without changing conversion or export bytes.
characters 
{{ values.pem_text }}
FieldValueMeaningCopy
{{ row.label }}{{ row.value }}{{ row.note }}
CheckStatusEvidenceCopy
{{ row.label }}{{ row.status }}{{ row.evidence }}
RSA Keys Converter Rewrap an existing RSA key for PKCS#1, PKCS#8 or SPKI consumers with optional encrypted output and local public-identity checks.
PEM Bundle Extractor Split a PEM bundle into complete certificates, requests, and keys while preserving line spans and adding SHA-256 evidence through local file handling.
Secure Shell (SSH) Public Key Converter Convert SSH public keys among OpenSSH, SSH2 and PEM locally while verifying key identity through matching SHA-256 fingerprints and safety checks.
Certificate Signing Request (CSR) Decoder Decode a CSR in your browser, verify its self-signature and requested names, and flag key, digest, SAN, or hostname issues before submission.

Identity platforms and token verifiers often describe a public key in different containers. OAuth, OpenID Connect, and JSON Web Token systems commonly publish JSON Web Keys, while certificate tools and cryptographic libraries often expect a PEM block. Conversion keeps the mathematical key material intact while changing how that material is represented.

A JSON Web Key (JWK) names key values as base64url-encoded JSON members. A JSON Web Key Set (JWKS) holds several JWK objects, often because keys are rotated over time. Selecting the correct member matters as much as encoding it correctly; a valid PEM made from the wrong set member will not verify the intended signatures.

SPKI
SubjectPublicKeyInfo, the generic public-key structure carried by a PUBLIC KEY PEM block.
PKCS#8
A generic private-key container carried by a PRIVATE KEY PEM block.
DER
The binary ASN.1 encoding placed inside either wrapper.
PEM
Base64 text armor around DER bytes with a matching header and footer.

Public and private conversion have different requirements. Public RSA material needs a modulus and exponent; elliptic-curve and octet key pair families need their public coordinates or byte string. Private output needs the private member d, and RSA private output also needs the complete set of prime and CRT values. Public JWKS documents normally omit those secrets.

A successful conversion proves that the selected members can be encoded into a supported key wrapper. It does not prove who owns the key, whether an issuer is trusted, whether a token is valid, or whether the advisory alg and use members match a deployment policy. Those questions require issuer metadata and an independent trust check.

How to Use This Tool:

Start from a trusted JWK or JWKS source and identify the exact key expected by the receiving system.

  1. Paste one JWK object or one JWKS document, or load a local JSON, JWK, JWKS, or text file. Correct malformed JSON or unsupported key members before continuing.
  2. If the source is a JWKS, choose Key from JWKS by its position and confirm the displayed kid, family, and public fingerprint against the intended issuer or deployment record.
  3. Leave Output PEM on Auto by key material for the usual result. Auto produces SPKI from public-only material and PKCS#8 when private member d is present; select SPKI explicitly to derive public output from a private JWK.
  4. Keep the conventional 64-character PEM wrap unless a receiving importer requires a width from 48 to 76 characters. Changing the wrap does not change the DER key bytes.
  5. Review the PEM label, resolved target, key family, JWK thumbprint, and DER SHA-256 fingerprint before copying or downloading the result.

Interpreting Results:

PUBLIC KEY identifies SPKI public output. PRIVATE KEY identifies PKCS#8 private output and must be handled as a secret. The label describes the wrapper, not the issuer, allowed algorithm, or trust status.

The JWK thumbprint and DER fingerprint answer different comparison questions. The thumbprint identifies the canonical public JWK members. The DER fingerprint identifies the exact binary object placed inside the PEM armor, so it can change when the wrapper or public/private target changes even though the underlying public key is the same.

For a JWKS, compare the selected index and kid with the expected key, then compare a cryptographic fingerprint. A matching kid alone is only a naming clue.

Technical Details:

JWK-to-PEM conversion decodes base64url members, constructs the key-family-specific ASN.1 structure, serializes it as DER, and wraps the DER bytes in PEM text. The family determines which members are required and which algorithm identifier enters the wrapper.

Transformation Core:

StageTransformationAudit point
Parse sourceAccept one JWK object with kty or one JWKS object with a nonempty keys array.Every selected entry must be a JSON object.
Select keyUse one member from the parsed key set.Confirm the displayed position and kid.
Decode membersConvert unpadded base64url members into unsigned integers or fixed-width byte strings.Invalid characters, impossible lengths, or missing members stop conversion.
Build DERConstruct SPKI for public output or PKCS#8 for private output using the family and curve identifier.Unsupported families, curves, or incomplete private material are rejected.
Build PEMBase64-encode DER, wrap lines at the selected width, and add matching boundary labels.Line wrapping changes text layout, not the DER object.

Key-Family Mapping:

FamilyPublic membersPrivate requirementSupported variants
RSAn, ed, p, q, dp, dq, and qi; multi-prime oth is rejectedSPKI public or PKCS#8 private
ECcrv, x, yd plus the public coordinatesP-256, P-384, and P-521
OKPcrv, xd plus the public valueEd25519, X25519, Ed448, and X448

Rule Core:

  • Auto target resolves to PKCS#8 when a nonempty private member d exists; otherwise it resolves to SPKI.
  • An explicit PKCS#8 request fails for public-only material. An explicit SPKI request discards private members and builds from the public JWK representation.
  • RSA bit length comes from the unsigned modulus. EC and OKP size labels come from the selected curve profile.
  • PEM wrap values are normalized to steps of four between 48 and 76 characters.

The RFC 7638 thumbprint uses only required public members in canonical name order: {"e","kty","n"} for RSA, {"crv","kty","x","y"} for EC, and {"crv","kty","x"} for OKP. The UTF-8 JSON bytes are hashed with SHA-256 and encoded as unpadded base64url. A second SHA-256 digest is calculated over the exported DER bytes and shown in hexadecimal.

The source is limited to 65,536 characters. Fingerprint preview length can be set from 8 to 32 characters, but this changes only the visible table preview; the full digest used by the conversion remains intact.

Security and Privacy Notes:

Conversion happens in the browser, and the source JSON is not added to the shareable URL. Browser-local processing does not make an exposed private JWK safe after it has been copied, downloaded, logged, or pasted elsewhere.

  • Treat d, RSA prime and CRT members, and every generated PRIVATE KEY PEM as secret key material.
  • Do not infer trust from successful DER construction, a familiar kid, or advisory alg and use values.
  • Verify the selected public key against authoritative issuer metadata, a certificate, or a deployment fingerprint before production use.

References: