Convert RFC 7517 JSON Web Keys (JWK / JWKS) to PKCS#8 / SPKI PEM format and convert public/private PEM keys to JWK structures.
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0S1CTzIxxA0411a/i9zB
d5knsWNuaAykjSmrckqv7gH8SZgu7pRRUcYQvmsNSR80dSSmqI3fu/EJIaBSCIdw
tDr/ci1qeqRPHXz+52sCFy+DfZU16bLIH70UIVZAu5keLFpWuJ5cNpzxl7MqDGU4
RHWPMqfE4GVSnEzhZ6/+EWpCWqHnu6UVZ9qohjo63eUekTDJMbJjfYYt08JSIGOJ
HXUePxdqxjg7xOzqQ1q8BY249nzSgyvxYPwpGEPvLhxk4L9VrF9uy/v5uT/FG3NW
Fur2s/LaOjKvejvbpvb1nbBTljl/JT+j8cWWjs+5JBLJ0C/y9QRhQeUeR+UsY0HU
bwIDAQAB
-----END PUBLIC KEY-----Zero server transmissions or analytics telemetry. Private keys and sensitive key pairs are transformed strictly inside browser memory.
Full support for RSA (2048/4096-bit), ECDSA (P-256, P-384, P-521), SPKI public keys, PKCS#1, and PKCS#8 private structures.
Derives deterministic RFC 7638 SHA-256 thumbprints, retains standard key IDs (kid), and produces standards-compliant JWKS envelopes.
Convert RFC 7517 JSON Web Keys (JWK / JWKS) to PKCS#8 / SPKI PEM format and convert public/private PEM keys to JWK structures.
Cryptographic family identifier defining the key algorithm structure according to RFC 7517 Section 4.1.
Required curve designation for Elliptic Curve and Octet Key Pair keys as defined in RFC 7518 Section 6.2.
Target ASN.1 DER encapsulation format armored with standard PEM boundary delimiters.
Intended public key usage designating digital signature verification ('sig') or payload encryption ('enc').
Unique key identifier string used during JWT header matching in OpenID Connect and OAuth 2.0 JWKS endpoints.
Modern Web Crypto APIs, OpenSSL 3.0, and cloud identity platforms require SubjectPublicKeyInfo (SPKI) format ('-----BEGIN PUBLIC KEY-----'). Legacy PKCS#1 headers ('-----BEGIN RSA PUBLIC KEY-----') must be converted to SPKI before importing into standard JWK structures.
RFC 7517 mandates Base64URL encoding without '=' padding and with '-' and '_' replacing '+' and '/'. When manually editing modulus 'n' or coordinates 'x'/'y', strip trailing '=' padding to prevent verification exceptions in libraries like jose and jsonwebtoken.
When integrating with OAuth 2.0 / OIDC providers (Auth0, Okta, AWS Cognito, Keycloak), match the incoming JWT header 'kid' against the 'keys' array in /.well-known/jwks.json to convert the exact verification public key to PEM.
Always export private keys using standard unencrypted PKCS#8 ('-----BEGIN PRIVATE KEY-----') format when bridging between JWK and server runtimes like Node.js crypto, Go crypto/x509, and Python cryptography.
Ensure your PEM begins with an authentic delimiter such as '-----BEGIN PUBLIC KEY-----' (SPKI), '-----BEGIN PRIVATE KEY-----' (PKCS#8), or '-----BEGIN RSA PUBLIC KEY-----' (PKCS#1). Remove extra trailing spaces, carriage returns (\r\n vs \n), or HTML entities.
Verify that the curve ('crv') matches the signature algorithm (e.g., ES256 requires P-256; ES384 requires P-384; RS256 requires 2048+ bit RSA modulus). Ensure coordinate fields 'x' and 'y' are zero-padded to the exact curve coordinate byte length.
Encrypted PEM keys starting with '-----BEGIN ENCRYPTED PRIVATE KEY-----' contain password-based PBKDF2/AES wrapping. Decrypt the key using OpenSSL ('openssl pkcs8 -topk8 -nocrypt -in encrypted.pem -out private.pem') before importing to JWK.
JWK (RFC 7517) represents cryptographic keys as JSON objects using Base64URL parameters, optimized for web APIs and microservices. PEM (RFC 7468) is a textual format encoding ASN.1 DER binary data between ASCII boundary lines, standard in TLS certificates and OpenSSL.
Yes. When pasting a complete JSON Web Key Set object with a 'keys' array, each key is parsed individually, allowing you to export corresponding SPKI PEM public keys with their original Key IDs.
Yes, 100%. All cryptographic transformations, ASN.1 parsing, and Base64URL transcodings execute entirely in client-side memory using the Web Cryptography API. No private keys or parameters are ever sent to an external server.
The converter supports NIST curves P-256, P-384, P-521, SECG secp256k1, and Edwards Ed25519, alongside 1024, 2048, 3072, and 4096-bit RSA keys for public and private conversions.
Public PEM keys (SPKI) only contain public parameters ('n' and 'e' for RSA; 'x' and 'y' for EC). The 'd' parameter represents the private exponent or scalar and is only generated when converting from private keys (PKCS#8, PKCS#1, or SEC1).
Build and validate modern Permissions-Policy HTTP response headers (camera, geolocation, microphone, payment) with strict origin allowlists.
Generate HTTP Strict-Transport-Security (HSTS) headers with max-age calculator, includeSubDomains, and Chrome preload readiness check.
Create production-hardened Linux sshd_config files disabling root login, enforcing public keys, limiting ciphers, and setting idle timeouts.
Generate Ubuntu UFW firewall rules, default drop policies, rate limiting, and port forwarding commands with an executable bash script.
Construct iptables rules for INPUT/FORWARD/OUTPUT chains, stateful inspection, SYN flood protection, NAT port forwarding, and script export.
Build and validate RFC 7208 compliant SPF TXT records with IPv4/IPv6 CIDR ranges, MX, A, include mechanisms, and soft/hard fail policies.