JWK ⇄ PEM Key Converter

JSON Web Keys (JWK) and PEM-encoded keys show up interchangeably across JWT libraries, TLS tooling, and OAuth/OIDC configuration, but converting between the two by hand means base64-decoding DER structures or reformatting JSON — easy to get subtly wrong. This tool does the conversion with the browser's real Web Crypto API instead of text manipulation: a pasted PEM block is imported with crypto.subtle.importKey('spki'|'pkcs8', ...) and re-exported as JWK with exportKey('jwk', ...); a pasted JWK is imported with importKey('jwk', ...) and re-exported as SPKI or PKCS8 DER, then wrapped in the correct PEM header. Because the browser itself validates and decodes the key material, a malformed key or a mismatched algorithm selection fails loudly instead of silently producing garbage.

Supported algorithms are RSA (RSASSA-PKCS1-v1_5), EC on the P-256/P-384/P-521 curves, and — where the browser implements them — Ed25519 and X25519. Browser support for Ed25519/X25519 in Web Crypto is still inconsistent across engines, so instead of guessing from the user agent string, the tool runs an actual crypto.subtle.generateKey() probe for the selected curve and tells you plainly if it is not supported here, rather than returning a fabricated result.

Every conversion also decodes the key's real metadata: for RSA keys, the modulus bit length and hash algorithm straight from the CryptoKey object; for EC and OKP keys, the named curve; and for every key, the RFC 7638 JWK thumbprint — a SHA-256 hash of the JWK's required members serialized in strict lexicographic order (e/kty/n for RSA, crv/kty/x/y for EC, crv/kty/x for OKP/Ed25519/X25519). This thumbprint is what many systems use as a key's "kid" identifier, and getting the member order wrong produces a different hash entirely, which is exactly the kind of mistake a hand-rolled implementation is prone to.

Because everything runs through crypto.subtle in your own browser tab, private key material never leaves your device — there is no server, no upload, and no external API call involved at any point in the conversion.