PEM ↔ JWK Key Converter & Inspector
Convert RSA and EC keys between JWK, public SPKI PEM and private PKCS#8 PEM locally with sensitive-output safeguards.
Keys stay in this browser tab. Conversion does not establish trust or prove key correctness. No signing, decryption or external requests are performed.
Ready.
Convert key representations using Web Crypto.
Public JWK converts to SPKI PUBLIC KEY PEM; private JWK converts to PKCS#8 PRIVATE KEY PEM. PEM converts back to JWK. RSA signatures use an explicit RS256/384/512 or PS256/384/512 selection, with 2,048–8,192-bit moduli. EC uses ES256/P-256 or ES384/P-384. A successful import is not a trust or full mathematical key-correctness proof.
Inspect public metadata without exposing private parameters.
Inspect key type, selected algorithm, intended signature usage, curve and public coordinates, RSA modulus size and exponent. JWK kid is displayed if supplied. PEM does not preserve JWK metadata. JWK exports use the selected algorithm and signature purpose; incompatible alg, use, key_ops and non-extractable ext declarations are rejected instead of silently overridden.
Handle private keys deliberately.
Private key material is accepted for legitimate conversion and stays in this browser’s memory. Private output is hidden until revealed. Copying requires acknowledging that the full private key leaves the tab for the system clipboard. Reset and page exit clear state, but JavaScript cannot guarantee secure memory erasure or clear external clipboard history. Never paste a production key on a shared or untrusted device.
Understand format and fingerprint limits.
Inputs are limited to 32 KiB, one strict JWK object or one matching PEM block. Canonical Base64/Base64URL, required public/private fields and DER framing are checked before native import. Encrypted PEM, PKCS#1, certificates, multi-prime RSA, P-521 and Ed25519 are unsupported. Use the X.509 inspector for certificates.
The SHA-256 fingerprint hashes canonical public SPKI DER exported by Web Crypto. For private inputs, public parameters are imported separately to produce the same fingerprint as the corresponding public key. It is not a certificate fingerprint. No signing, decryption, key-server lookup or network validation occurs.