How to use
Paste a JWK (one key as a JSON object) or a JWKS ({"keys":[…]}) into the input. Pasting PEM (-----BEGIN…) switches to converting PEM into a JWK.
Each key gets a row with kty, kid, alg, curve, size, whether it is public or private, and its JWK thumbprint. Problems appear under the row with the reason and the member involved.
Use “Convert” to turn the chosen key into PEM or into a public JWK without its secret members. For the whole JWKS, the public set is built with each missing kid set to its thumbprint.
Inputs and outputs that contain private keys are hidden by default. “Show” reveals them.
Copy or save the result. To create a new key pair, use the crypto tool.
What it does
JWK and JWKS in one screen
Recognizes RSA, EC, OKP (such as Ed25519) and oct keys, and tabulates kid, use, key_ops, alg, curve, size and whether each key is public or private.
Checks against the RFCs
Checks RFC 7517, 7518 and 8037: missing required members, invalid base64url, alg that does not match the kty or curve, coordinate lengths for each curve, use that conflicts with key_ops, and duplicate kid values.
Warns about private members
A public JWKS containing d, p, q, dp, dq, qi or oth (or k for oct) is reported as an error on that key. A single private JWK is treated as a normal input.
JWK Thumbprint (RFC 7638)
Takes only the required members listed in RFC 7638 §3.2, hashes them with SHA-256 and shows the base64url value, with a copy button.
JWK and PEM both ways
WebCrypto writes public keys as SPKI and private keys as PKCS#8 PEM, and reads them back into JWK. Keys WebCrypto cannot handle are not converted, and the reason is shown.
Secrets hidden by default
Inputs and outputs with private keys are masked, and nothing is saved to localStorage or elsewhere. Closing the page clears everything.
Use cases
- Check the type, kid and size of the keys in a JWKS you received
- Make sure a public JWKS has no private members such as d, p or q
- Convert a public JWK to PEM for OpenSSL or another library
- Set kid to the RFC 7638 thumbprint so each key can be told apart
Supported formats
Input
Key types
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| JWK and JWKS checks (required members, base64url, alg vs kty and curve) | Supported | — |
| JWK Thumbprint (RFC 7638, SHA-256) | Supported | — |
| JWK → PEM (SPKI for public, PKCS#8 for private) | Partial | Only keys WebCrypto supports. Ed448, X448 and secp256k1 cannot be converted; Ed25519 can fail in some browsers |
| PEM → JWK | Partial | SPKI and PKCS#8 for RSA, EC, Ed25519 and X25519 only. PKCS#1 and encrypted PEM are not supported |
| Public JWK from a private key | Supported | Removes d, p, q and the others, keeping only the public members the key type needs |
| Setting kid (thumbprint as kid) | Supported | — |
| Key generation | Not supported | Generate keys with the crypto tool (crypto_studio) |
| Signing, verification, encryption, JWT verification | Not supported | This tool only inspects and converts keys |
| Fetching a JWKS from a URL | Not supported | No network requests. Paste the JWKS instead |
| PEM for symmetric keys (oct) | Not supported | Symmetric keys have no PEM form |
| Offline use | Supported | Works without a connection once loaded |
Limits & notes
- Input up to 200,000 characters; a JWK Set can hold up to 500 keys.
- RSA size is the real bit length of n. Keys under 2048 bits get a warning (RFC 7518 §3.3 requires 2048 bits or more for RS256 and similar).
- Pairing of a private and a public key is not checked, and the mathematical validity of a key is not checked either.
- Certificates (BEGIN CERTIFICATE), PKCS#1 PEM and encrypted PEM are not handled. Check certificates with a certificate tool.
- Private key values are for reading on this page only. The tool does not save them.
Privacy & safety
JWKs, JWK Sets and PEM you paste are processed only inside your browser and are never sent to or stored on a server. Inputs and outputs with private keys are hidden by default, and closing the page clears everything.
FAQ
What is the difference between a JWK and a JWKS?
What is a JWK Thumbprint (RFC 7638)?
Why is a private member in a JWKS a problem?
How is the RSA key size determined?
Why can some PEM files not be converted to JWK?
How do I create a new key?
Related tools
Crypto Studio — Hash, HMAC, Encryption & Keys
Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.
Certificate, CSR & PEM Studio
Reads PEM, DER (.cer/.crt), CSR and PKCS#7 (.p7b) and lists the subject, expiry (days left), SANs, public key, signature algorithm and SHA-256 fingerprint. It also checks chain order and signatures and converts PEM and DER. Everything runs in your browser and private keys are never read.
Encode / Decode Studio — Base64, URL, JWT & more
Paste %E3%81%82, an eyJ… token or any encoded string — the format is detected and decoded instantly. Errors say exactly which character is wrong and why, and nothing leaves your browser.
OAuth / PKCE Studio — Code Verifier, Challenge & Auth URL
Generate a PKCE code_verifier or check one you paste, then compute the S256 code_challenge. Build the authorization request URL, and check whether the state in the callback matches the one you sent. PKCE is for public clients and needs no client_secret. Token exchange needs network access, so this tool only shows the curl command.
Diff Tool — Text & Code Compare
Paste or drop two versions and see added and removed lines, plus the exact words that changed inside each line. Copy or save the result as a unified patch. Nothing leaves your browser.
UUID / ULID / NanoID / Token Generator
A UUID is ready the moment the page opens. Switch to UUID v7, ULID, NanoID or a random token, generate up to 10,000 at once and save them as .txt, .csv or .json. Paste an existing UUID or ULID to read its embedded time and version.
Last updated: