JWK ↔ PEM ↔ Base64 Key Converter

What this tool does

It converts a public key between the three representations credential work tends to demand: JSON Web Key (the JSON form used in DID documents and JOSE), SPKI PEM (the -----BEGIN PUBLIC KEY----- form OpenSSL prints), and raw key bytes in hex and base64url. Input is auto-detected — an object is parsed as a JWK, anything else as PEM. Ed25519 keys round-trip directly, including a correctly assembled standard SPKI wrapper; RSA and ECDSA P-256 keys go through the browser's native WebCrypto import and export. Three panes show the normalized JWK, the PEM, and the raw bytes side by side.

How to use it

1. Paste a JWK object or a PEM block — or load the Ed25519 JWK or RSA-2048 PEM sample to watch the round trip.
2. Press Convert Across All Formats.
3. Copy the pane you need: JWK for DID documents and JWT libraries, PEM for OpenSSL and ssh-keygen tooling, hex or base64url for low-level debugging.

Where your data goes

Everything runs in your browser: Ed25519 bytes are re-packed locally, and RSA and ECDSA keys are imported and exported through crypto.subtle — the browser's own WebCrypto implementation. No libraries are loaded, no network call is made, nothing is stored. The standing rule for any key tool applies here too: this page is built for public keys. Don't paste private keys into web pages — this one included.

Who it's for

Anyone publishing a did:web document who has a PEM from OpenSSL and needs the matching JWK for its verificationMethod; anyone holding a JWK that a tool on the other side wants as PEM; and anyone staring at a key file wondering which representation they are actually holding. It's the small, boring conversion that otherwise means hunting down a gist with a Python script.

Honest limits

• Public keys only. There is deliberately no PKCS#8 private-key path — SPKI only. Treat every web page, including this one, as the wrong place for private key material.
• JWK input handles two families: Ed25519 (OKP, needing the x coordinate) and RSA (needing a well-formed modulus and exponent).
• PEM input auto-detects three shapes: Ed25519 SPKI, RSA SPKI, and ECDSA P-256. Other curves — P-384, P-521, secp256k1 — fail with an honest error rather than a wrong answer.
• RSA conversion goes through WebCrypto, which requires a secure context: any normal https page qualifies, including this one; a local file:// copy of the page may not.

Questions people ask

Which pane is the "real" key?

All three. Same key bytes, different containers: the JWK holds the raw coordinates as JSON, the PEM wraps the same bytes in a DER structure with a standard header, and the hex pane shows the raw bytes with no wrapper at all. Converters change the container, never the key.

Can I convert a private key here?

No — deliberately. For PKCS#8 private-key conversion, use openssl locally. Private key material has no business in a browser tab, whoever's tab it is.

Back to the verifiers hub for the signature and revocation tools.