JWK / PEM Key Converter
Convert RSA, EC, Ed25519 and X25519 keys locally with Web Crypto. Export public material by default and private keys only when selected.
Convert key material, not application policy
Supported keys are RSA, EC P-256/P-384/P-521, Ed25519 and X25519, subject to the browser’s native Web Crypto support. Input is one JWK or one supported PEM/DER key. JWK sets and symmetric oct keys have no supported PEM export here.
PEM output uses SPKI for public keys and PKCS#8 for private keys. PKCS#1 RSA input is wrapped in the corresponding standard container; SEC1 EC input needs its named-curve OID. A certificate can supply its public-key structure, but this does not validate its issuer or trust chain.
Public by default
When private input is detected, the default result contains public components only. Select Include private key to export the private material. A private RSA JWK requires complete two-prime CRT fields; multi-prime private keys are unsupported. Private/public consistency is checked with a sign/verify challenge, or X25519 base-point derivation.
JWK metadata such as kid, alg, use, key_ops, ext and x5c is not preserved: PEM cannot carry the same application policy. The result is bare key material with no invented permissions. Conversion uses extractable temporary keys and does not claim to bypass restrictions on hardware-held or browser-held keys.
Reference
Questions & answers
Why did a private key become public?
Public output is the default. Enable Include private key explicitly when you need a private export, then protect the downloaded file.
Does conversion preserve JWT algorithm restrictions?
No. Reapply and validate alg, use and key_ops in the destination application. Key format and application authorization are different concerns.
Is my input uploaded?
No. Processing runs in your browser. Engines load from this site; the tool does not send input to a processing API or save it. Clear removes the visible input and result.