JWKS to PEM Converter
Paste a JWKS (JSON Web Key Set) or a single JWK — RSA or EC — and convert it to PEM format, the format most TLS libraries, OpenSSL, and Cryonel's own JWT Decoder expect.
How to use it
Paste a full JWKS ({"keys":[...]}) or a single JWK object. If the set has more than one key, pick one from the dropdown by its kid. Both RSA and EC (P-256/P-384/P-521) keys are supported. The output is always a public key in SPKI PEM format.
JWK, JWKS, and PEM
A JSON Web Key is one key represented by JSON fields. A JSON Web Key Set wraps one or more JWK objects in a keys array, commonly so an identity provider can publish current signing keys. PEM is a text-armored representation used by many cryptographic libraries and command-line tools. This converter changes a supported public JWK into an SPKI public-key PEM block; it does not fetch, register, or trust the key.
Select the intended key
A set may contain several keys during rotation or because different algorithms and uses are supported. The JWT kid header is normally used to find a candidate with the same kid, but the value is only a selector supplied by the token. Also check the trusted issuer, allowed algorithm, key type, declared use or key operations when present, and the verifier's policy. Never accept a key merely because an untrusted token points to it.
RSA and EC conversion
An RSA public JWK carries the modulus in n and exponent in e. An elliptic-curve JWK carries a named curve plus the public point coordinates in x and y. Those values use URL-safe Base64 encoding. The converter validates the supported structure through browser cryptography before exporting SPKI PEM, which catches many malformed or incompatible parameters without exposing them to a remote service.
Key rotation and cache behavior
Identity providers add and retire signing keys over time. A missing kid may mean the token came from another issuer, the verifier cached an old JWKS, the provider is rotating keys, or the token itself is stale or forged. Refresh through the provider's documented endpoint and cache policy, but do not retry an arbitrary URL taken from token data. Keep previously trusted keys only for the overlap period required by the issuer and token lifetime.
PEM output is not token verification
Producing a PEM block only makes the public key usable by software that expects SPKI. JWT verification must still validate the cryptographic signature and application claims such as exact issuer, audience, expiry, not-before time, and permitted algorithm. Use JWT Decoder for local inspection and the JWKS key troubleshooting guide when selection fails. Decoding or conversion alone never authenticates a request.
Privacy and private-key boundaries
Published JWKS documents normally contain public material. This page does not support converting private JWK parameters and does not make outbound requests. Pasted content remains in the current tab. Even public keys can reveal tenant names, rotation timing, or internal identifiers, so avoid sharing private endpoint responses unnecessarily and clear the workspace after investigating a restricted environment.
Frequently Asked Questions
Where do I get a JWKS?
Most OAuth/OIDC identity providers publish one at a /.well-known/jwks.json endpoint. Fetch it yourself and paste the contents here — this tool doesn't fetch URLs for you, to keep every Cryonel tool free of outbound network calls.
Can I convert a private key?
No — JWKS entries published by identity providers are public keys only (that's the point: they're safe to publish). This tool only produces public-key PEM output.
Does the PEM output verify a JWT?
No. It only changes public-key representation; verification must still check the signature, issuer, audience, time claims, and algorithm policy.