JWK / JWKS / PEM Converter

How to use the JWK / JWKS / PEM Converter

Convert public and private keys between PEM and JWK, validate and clean up a JWKS for publication at .well-known/jwks.json, generate RFC 7638 kid thumbprints, and extract an x5c certificate chain to PEM. Supports RSA, EC (P-256 / P-384 / P-521), and Ed25519. Useful for OAuth / OIDC providers, microservices doing token verification, and key rotation. Runs locally in your browser — no network calls, no remote JWKS fetches.

What it does

• PEM ↔ JWK conversion (RSA, EC, Ed25519; public and private).
• JWKS generation from one or more keys, with kid, use, alg.
• RFC 7638 thumbprint generator for stable, content-derived kid values.
• Public-only cleanup: strips d, p, q, dp, dq, qi, and k from a JWK / JWKS so it is safe to publish.
• x5c → PEM certificate chain extraction.
• JWKS validation: required fields, kty / alg coherence, duplicate kid warnings.

When to use it

• Publish a public JWKS while ensuring private fields are removed.
• An OIDC provider gives a JWKS and your service needs a public PEM key for verification.
• Generate a deterministic kid (RFC 7638) so rotated keys are unambiguous.
• Convert an x5c certificate chain in a JWK to a PEM bundle.
• Rotate signing keys and publish the new public JWK alongside the old one.

How to use it

1. Paste the input (PEM block, JWK JSON, or JWKS).
2. Choose the output format: public/private JWK, JWKS, PEM, or x5c → PEM.
3. Read the verdict, then open the Keys, Thumbprints, and Readiness tabs to review validation.
4. Copy the converted output. For publication, host it at .well-known/jwks.json.
5. For full token sign / verify, hand off to the JWT & OAuth Toolkit.

Tips & pitfalls

• Public keys verify; private keys sign. Never publish a private JWK.
• oct symmetric keys are secrets — do not place them in a published JWKS.
• Do not trust kid, jku, or x5u alone — always apply issuer, audience, and allowed-algorithm checks in the verifier.
• RFC 7638 thumbprints are deterministic — same public key always yields the same kid. Good for rotation.
• Keep both old and new public keys in the JWKS during a rotation window so existing tokens still verify.
• Some libraries cache JWKS aggressively — bust the cache when rotating.

FAQ

• How do I convert a PEM public key to JWK? Paste the PEM block and choose a JWK / JWKS output format.
• How do I publish a JWKS? Generate a public JWKS from one or more public keys and host the resulting JSON at https://your-domain/.well-known/jwks.json.
• What is an RFC 7638 thumbprint? A SHA-256 hash of a canonical JWK representation, used as a stable kid. See the Thumbprints tab.
• Is anything uploaded? No. All conversion runs locally in your browser. The tool never fetches a remote JWKS URL.
• What algorithms are supported? RSA (RS256, RS384, RS512, PS256, PS384, PS512), EC (ES256, ES384, ES512), and EdDSA.

Runs locally in your browser. No uploads. No remote JWKS fetches. Always strip private fields before publishing a JWKS.

Related guides

• Convert a JWK / JWKS to PEM