PEM to JWK converter

Which PEM shapes import

Paste an SPKI public key (BEGIN PUBLIC KEY) or PKCS#8 private key (BEGIN PRIVATE KEY). The browser Web Crypto import extracts the RSA or EC parameters and emits JWK JSON with kty, n/e or curve coordinates, and d only for private keys.

Encrypted PEM (BEGIN ENCRYPTED PRIVATE KEY) and legacy PKCS#1-only blocks may not import depending on browser support. Convert those with OpenSSL locally first if needed.

Worked example: RSA public and private keys

An SPKI RSA public PEM becomes a JWK with "kty":"RSA", modulus n, and exponent e (often AQAB). A matching private PKCS#8 adds private fields such as d. Pretty-printed JSON is easier to paste into JWKS documents; minify before embedding in configs if size matters.

Limits

Keys never leave this tab, but screen sharing still exposes them. Do not paste production private keys into a shared demo. This tool does not mint certificates, rotate keys, or talk to a KMS.

Worked example: RSA vs EC P-256 output

Paste a public key that begins with -----BEGIN PUBLIC KEY-----. For an RSA key the JWK has "kty":"RSA" with n (modulus) and e (usually AQAB, which is 65537). For an EC P-256 key it has "kty":"EC", "crv":"P-256", and the x and y coordinates. Add kid, use, and alg yourself if your JWKS consumer needs them.

Pitfalls

• Publishing a private key. A private JWK contains d (and for RSA p, q, and more). Never put those in a public JWKS endpoint.
• PKCS#1 headers. BEGIN RSA PUBLIC KEY is a different format from BEGIN PUBLIC KEY (SPKI). Convert with openssl rsa -RSAPublicKey_in -pubout if needed.
• Certificates. BEGIN CERTIFICATE wraps a public key in an X.509 certificate. Extract the key first with openssl x509 -pubkey -noout.

Convert PEM to JWK in code

Each snippet reads an SPKI public key PEM, exports it as a JWK and sets kid to the RFC 7638 thumbprint. All three print the same kid for the same key.

JavaScript: jose

import { importSPKI, exportJWK, calculateJwkThumbprint } from "jose"; // npm i jose
import { readFileSync } from "node:fs";

const pem = readFileSync("public.pem", "utf8"); // -----BEGIN PUBLIC KEY-----
const key = await importSPKI(pem, "RS256", { extractable: true });
const jwk = await exportJWK(key);
jwk.kid = await calculateJwkThumbprint(jwk); // RFC 7638 thumbprint as kid
console.log(JSON.stringify({ ...jwk, alg: "RS256", use: "sig" }));
// Private keys: importPKCS8(pem, "RS256", { extractable: true })

Python: jwcrypto

import json
from jwcrypto import jwk  # pip install jwcrypto

with open("public.pem", "rb") as f:
    key = jwk.JWK.from_pem(f.read())  # SPKI public or PKCS#8 private

public = key.export_public(as_dict=True)
public["kid"] = key.thumbprint()  # RFC 7638, SHA-256
print(json.dumps(public))

Go: github.com/lestrrat-go/jwx/v3

package main

import (
	"encoding/json"
	"fmt"
	"os"

	"github.com/lestrrat-go/jwx/v3/jwk" // go get github.com/lestrrat-go/jwx/v3
)

func main() {
	pem, err := os.ReadFile("public.pem")
	if err != nil {
		panic(err)
	}
	key, err := jwk.ParseKey(pem, jwk.WithPEM(true))
	if err != nil {
		panic(err)
	}
	if err := jwk.AssignKeyID(key); err != nil { // RFC 7638 thumbprint as kid
		panic(err)
	}
	out, _ := json.Marshal(key)
	fmt.Println(string(out))
}

Each snippet was run on October 14, 2026 with jose 6.2.12, jwcrypto 1.6.1 and jwx v3.3.0.

JWK and PEM specs

• RFC 7517: JSON Web Key (JWK)
• RFC 7518, section 6: key parameters: n and e for RSA, crv, x and y for EC
• RFC 7638: JWK Thumbprint: a stable kid computed from the key itself
• RFC 7468: textual encodings (PEM): BEGIN PUBLIC KEY and BEGIN PRIVATE KEY labels
• RFC 5958: Asymmetric Key Packages (PKCS #8)
• jwcrypto JWK documentation
• Go: jwx v3 jwk package

FAQ