JWKS to PEM

Pick the right public key first, then emit PEM for verifiers and libraries

Safety note: This page only emits public-key PEM output. If you paste a private JWK, private members are ignored and the page warns you before you copy anything.

Turn a selected JWK into PEMPaste one JWK or a full JWKS, choose one key, and emit a PEM public key block for verifiers and libraries that still expect PEM

Use kid when the JWKS has multiple keys. The expected algorithm is only a selection hint and never changes the emitted key.

JWK or JWKS JSON

Public PEM output

Preferred kid (optional)

Add kid when the JWKS has multiple compatible keys and you need one exact match.

Expected JWT algorithm (optional)

Examples: RS256, PS256, ES256. This field helps narrow the selection only.

What It Emits

This page turns the selected RSA or EC public JWK into a PEM PUBLIC KEY block. It does not emit private-key PEM, and it strips private JWK members before conversion when they appear in the pasted JSON.

Convert a Selected Key

Paste one JWK or a full JWKS document.
Add kid when the set contains multiple keys, or supply the expected JWT algorithm if that narrows the choice safely.
Click Convert to PEM and review the selected key summary.
Copy the PEM block or the sanitized public JWK shown above.

When You Still Need kid

Algorithm hints can narrow a JWKS, but they do not always choose one key safely. If the issuer publishes more than one compatible key, this page asks for kid instead of guessing.

FAQ

Does this convert private keys to PEM?

No. This page only emits public-key PEM output for the selected RSA or EC key.

Can it use x5c instead of JWK members?

Not in this wave. Paste JWKs that include the public members needed for conversion.

Is anything uploaded to a server?

No. JWK parsing and PEM conversion stay in your browser.